Stack Overflow
Stack Overflow

Questions tagged [scapy]

Scapy is a network packet manipulation tool for use with Python.

What is Scapy?

Scapy is a network packet manipulation program for use with Python. It is able to:

  • forge or decode packets of a wide number of protocols
  • send them on the wire, capture them, match requests and replies, and much more. It can easily handle most classical tasks like scanning, tracerouting, probing, unit tests, attacks or network discovery. (it can replace hping, 85% of nmap, arpspoof, arp-sk, arping, tcpdump, tethereal, p0f, etc.)

What makes scapy different from most other networking tools?

  • You can build whatever packets you want, stack ARP on top of 802.11, use double 802.1q encapsulation or send an ICMP packet with padding, and send them over the wire.

  • Scapy does not interpret answers: unlike most tools, it won't say “this port is open” instead of “I received a SYN-ACK”. You are free to interpret the packets as you want

  • It reports everything: you see the padding, the reserved fields... Nothing is dismissed

Useful links:

2198 questions
7
votes
2 answers

Calculate bandwidth usage per IP with scapy, iftop-style

I'm using scapy to sniff a mirror port and generate a list of the top 10 "talkers", i.e. a list of hosts using the most bandwidth on my network. I'm aware of tools already available such as iftop and ntop, but I need more control over the…
Banjer
  • 8,118
  • 5
  • 46
  • 61
7
votes
1 answer

Get IP addresses from PCAP file in scapy

Is there a smart and fast way to get all IP addresses from a PCAP file? I need only (destination address, source address) tuples. Currently I'm using Scapy's rdpcap function like this: from scapy.all import * pcap = rdpcap('file.pcap') ips =…
reox
  • 5,036
  • 11
  • 53
  • 98
7
votes
1 answer

Scapy PcapReader and packets time

I'm reading a PCAP file using Scapy using a script such as the (semplified) following one: #! /usr/bin/env python from scapy.all import * # ... myreader = PcapReader(myinputfile) for p in myreader: pkt = p.payload print pkt.time In this…
auino
  • 1,644
  • 5
  • 23
  • 43
7
votes
1 answer

how to add http headers to a packet sniffed using scapy

I am trying to sniff an out going http packet using scapy, add a few new http headers in it and send it ahead. The intention here is to only insert new headers while keeping the packet intact. At max any checksum recalculation should be done if…
fkl
  • 5,412
  • 4
  • 28
  • 68
7
votes
1 answer

Network bridge using Scapy and Python

I am creating a network bridge that connects two ethernet cards on the same machine. One of the cards is connected to the LAN and the other is connected to a network device. It looks something like this, I am sniffing packets on both the interfaces…
Abhinav
  • 992
  • 2
  • 11
  • 26
7
votes
1 answer

Specify timestamp on each packet in Scapy?

With Scapy, when I create a packet and write it to a pcap file, it sets the timestamp of the packet to the current time. This is my current usage. 1335494712.991895 being the time I created the packet: >>> a =…
gak
  • 32,061
  • 28
  • 119
  • 154
6
votes
2 answers

Recognize telnet protocol with Scapy python

I am reading a Pcap file with Scapy. How can I recognize if, in this pcap file, there is a packet that uses the Telnet protocol? I see that Scapy can write 'telnet' into dport/sport only if 1 of those ports is 23, but if I am using another port for…
MicrosoctCprog
  • 460
  • 1
  • 3
  • 23
6
votes
0 answers

Capturing CTS frame with Scapy and python

I have my WiFi card in monitoring mode and listening packages from Python with Scapy. I'm also sending RTS request and hoping to pickup CTS reply but it never happens. (I expect it to be type 1, subtype=12.) Am I sending RTS package the right way?…
Ibiza
  • 149
  • 4
6
votes
2 answers

ICMP Ping packet is not generating a reply when using Scapy

I recently began exploring Scapy. A wonderful tool indeed! I have a problem... When I monitor my network card using Wireshark and I do a regular ping from the systems command prompt with the standard PING installation, wireshark pops up with "Ping…
Andesay
  • 229
  • 2
  • 4
  • 9
6
votes
1 answer

scapy: get DNSQR / DNSRR field values in symbolic/string form

I'm trying to decode DNS traffic and print query/response data and I'm using python/scapy to decode the packets. A code snippet: def dns_sniff_v2(pkt): if IP in pkt: if pkt.haslayer(DNS): dns = pkt.getlayer(DNS) …
André Fernandes
  • 2,335
  • 3
  • 25
  • 33
6
votes
1 answer

Sending a packet over physical loopback in scapy

I've recently discovered Scapy & it looks wonderful I'm trying to look at simple traffic over a physical loopback module / stub on my NIC. But Scapy sniff doesn't give anything What I'm doing to send a packet is: payload = 'data'*10 snf =…
YNWA
  • 680
  • 2
  • 9
  • 19
6
votes
1 answer

Scapy: Using a PacketListField to dissect multiple packets contained in a packet

I am trying to dissect packets, which encapsulate another packet-like structure, called "tags". The structure looks like this +---------+ |Ether | +---------+ |IP | a tag +---------+ |UDP | …
vicco
  • 1,049
  • 2
  • 14
  • 33
6
votes
2 answers

Ack number to acknowledge data in scapy

I'm playing around with scapy, trying to do a nmap-like, I succeeded doing a three way handshake and I automatically receive data if I connect to a smtp server but I can't acknowledge it. I have connected to it via netcat to see why it wouldn't work…
Jeff Bencteux
  • 1,406
  • 16
  • 27
6
votes
3 answers

Scapy in Python script

I'm writing a script in Python which use Scapy but my problem is that the exception is: i = IP() NameError: global name 'IP' is not defined This is my script: import random from scapy import * import threading import…
Ron Halfon
  • 105
  • 1
  • 2
  • 10
6
votes
1 answer

Scapy SYN send on our own IP address

I tried to send SYN packets on my local network and monitoring them with Wireshark and everything works just fine, except when i try to send a packet to my own ip address it "seems" to work because it says Sent 1 packet, but it is not really sent, i…
Nolhian
  • 574
  • 2
  • 7
  • 18
1 2 3
…
99 100