How can I extract TCP header for all the packets from a pcap file?

I don't know what format of the TCP headers you're looking for - each individual TCP header field or the raw bytes that comprise the TCP header, but here are some ideas using various tools:

If you want TCP header fields, you can get most of them using tshark. For example:

tshark -r file.pcap -T fields -e tcp.srcport -e tcp.dstport -e tcp.seq_raw -e tcp.ack_raw -e tcp.hdr_len -e tcp.flags -e tcp.window_size_value -e tcp.checksum -e tcp.urgent_pointer -e tcp.options

I indicated most since there's no way to know which TCP options, if any, might be present in any give TCP packet, so it'd be difficult to list each one individually and always guarantee that the output will make sense. I think the best you can do here is to just print the bytes that comprise all TCP options, which is what I've done here.

If instead you want the raw bytes that comprise the TCP header, then this is a bit trickier I think, although not necessarily impossible. One method that should work, at least in certain cases, involves a few steps and tools:

1. Remove the TCP payload. For this, I would recommend loading the capture file, say file.pcapng, into the freely available tool called Tracewrangler, written and maintained by Jasper Bongertz. To remove the TCP payload, load the capture file into the tool and run an "-> Anonymize Files" task, being sure to check the box that indicates, "Truncate Packets after layer: Layer 4 (TCP/UDP)". After running this task, you'll have a new capture file named file_anon.pcapng, which will be the same as the original file except without any TCP payload bytes present.

2. To further isolate the TCP header bytes, the framing and IP header bytes need to be removed as well, but unfortunately Tracewrangler doesn't support this. If all Framing and IP packet headers are the same size (for example, 14 bytes for Ethernet framing and 20 bytes IP header with no IP options), then you can use editcap to chop off the first 34 bytes of the packet to isolate the TCP header bytes. For example:

   editcap -T user0 -C 34 file_anon.pcapng file_anon_chopped.pcapng

Here I've also changed the encapsulation type from Ethernet (assuming it was Ethernet) to a user-defined type because the Ethernet framing bytes have been removed. To read the isolated TCP header bytes now, you can simply run:

tshark -r file_anon_chopped.pcapng -x

This may or may not produce output you're interested in though, so you'll just have to test it and see if it meets your needs. And of course this won't work if the IP headers aren't all the same fixed 20 byte size. Another possible Tracewrangler enhancement could be to remove all IP header options in order to guarantee the fixed size for all IP packets, but this too isn't supported [yet?].

By the way, it's not strictly necessary to do this, but if you want Wireshark to make proper sense of the TCP header bytes in the file_anon_chopped.pcapng file, then you'll need to edit Wireshark's DLT preference so Wireshark knows how to interpret those bytes. Basically, you have to tell Wireshark what the user0 encapsulation means. To do this, open Wireshark and navigate to "Edit -> Preferences -> Protocols -> DLT_USER -> Encapsulations Table -> Edit", and then add an entry for "User 0 (DLT=147)" to be decoded as tcp.

There may be other ways to achieve your goal, but I'm not familiar enough with a tool such as Scapy to be able to provide you with a solution using that tool.