scapy

scapy [options] [arguments]

Typically, invoking scapy without options launches its interactive Python shell. Options allow for direct command execution, script execution, or reading PCAP files upon startup.

-r <file>
    Reads packets from the specified PCAP (Packet Capture) file at startup.

-s <file>
    Executes the specified Python script file containing Scapy commands upon startup.

-c <command(s)>
    Executes the given Scapy command(s) directly from the command line, without entering the interactive shell. Multiple commands can be separated by semicolons.

-i <interface>
    Starts sniffing packets on the specified network interface upon startup. This can be combined with other options like -c.

-p <program>
    Runs a specific Scapy program or tool (e.g., 'traceroute', 'nmap', 'arpscan').

-q
    Operates in quiet mode, suppressing most informational messages and banners.

-v
    Increases verbosity, providing more detailed output during operations.

-h
    Displays the help message and exits, showing available command-line options.

Scapy is a powerful interactive packet manipulation program and library written in Python. It allows users to create, send, sniff, and decode network packets at various layers of the OSI model. Its flexibility makes it an invaluable tool for network discovery, security auditing, unit testing, penetration testing, and network development.

Unlike traditional sniffers or packet generators, Scapy provides a high degree of control over individual packet fields and layers, enabling the crafting of malformed packets, custom protocol implementation, and sophisticated network attacks or defenses. It can handle a wide array of protocols, from Ethernet and IP to higher-level protocols like HTTP, DNS, and more. Being Python-based, it easily integrates into larger scripts and automation workflows, offering a programmatic approach to network interaction and analysis.

Root Privileges: Many network operations, such as raw socket creation, packet sniffing, and injection, require root or elevated user privileges (e.g., using sudo) to function correctly.

Python Dependency: Scapy is a Python library and requires a compatible Python environment (Python 3.x is recommended) along with necessary dependencies to be installed.

Learning Curve: While powerful, mastering Scapy requires a foundational understanding of network protocols and Python programming, especially for complex packet crafting and analysis tasks.

When invoked without specific options, Scapy launches an interactive Python shell. This allows users to dynamically craft, send, and analyze packets using Python syntax, providing immediate feedback and a powerful environment for experimentation and debugging.

Beyond its command-line utility, Scapy is primarily a powerful Python library. It can be imported into any Python script, enabling the automation of complex network tasks, integration into larger testing frameworks, and development of custom network utilities.

Scapy provides an intuitive way to interact with various layers of the OSI model. Users can easily build packets layer by layer (e.g., Ethernet / IP / TCP / Raw), modify fields at any layer, and extend its functionality to support new or custom protocols. This deep-level control is one of its most significant strengths.

Scapy was created by Philippe Biondi and first released around 2003-2004. Its development aimed to provide a more flexible and interactive alternative to existing packet manipulation tools. From its inception, Scapy stood out due to its deep integration with Python, allowing users to leverage the language's power for complex network tasks. Over the years, it has continuously evolved with contributions from a vibrant community, adding support for new protocols and expanding its capabilities, solidifying its position as a go-to tool for network security and analysis professionals.

tcpdump(1), wireshark(1), nmap(1), netcat(1), tshark(1)