{"id":1876,"library":"scapy","title":"Scapy","description":"Scapy is a powerful Python-based interactive packet manipulation tool that enables users to forge, decode, send, and sniff network packets. It supports a wide array of protocols and can function as an interactive shell (REPL) or as a library within Python scripts. Scapy runs on Linux, macOS, most Unix-like systems, and Windows (requiring Npcap). The current version is 2.7.0, and it maintains an active release cadence.","status":"active","version":"2.7.0","language":"en","source_language":"en","source_url":"https://github.com/secdev/scapy","tags":["networking","packet manipulation","security","network analysis","protocol","sniffing","forging"],"install":[{"cmd":"pip install scapy","lang":"bash","label":"Install Scapy"}],"dependencies":[{"reason":"Mandatory for Scapy to function on Windows.","package":"Npcap","optional":false},{"reason":"Required on Unix-like systems for certain features, particularly BPF filter compilation.","package":"libpcap","optional":false},{"reason":"Optional, for plotting functionalities.","package":"matplotlib","optional":true},{"reason":"Optional, for generating PostScript (psdump) and PDF (pdfdump) diagrams, requires a LaTeX distribution.","package":"PyX","optional":true},{"reason":"Optional, for drawing network graphs and conversations().","package":"Graphviz","optional":true},{"reason":"Optional, often used with Graphviz for image processing in graph generation.","package":"ImageMagick","optional":true},{"reason":"Optional, for 3D graphics (trace3D()).","package":"VPython-Jupyter","optional":true}],"imports":[{"note":"Using `from scapy import *` may not import all necessary modules and functions, especially if there's a name collision with a local 'scapy.py' file. `from scapy.all import *` ensures all Scapy features are loaded.","wrong":"from scapy import *","symbol":"*","correct":"from scapy.all import *"}],"quickstart":{"code":"from scapy.all import *\n\n# Craft an IP packet with an ICMP payload\npacket = IP(dst=\"8.8.8.8\")/ICMP()\n\n# Send the packet and receive a response\n# Note: Requires root/admin privileges to send/receive raw packets\n# Use os.environ.get('SCAPY_IFACE', 'eth0') to specify an interface if needed\n# For simple testing, can often run as sudo python your_script.py\n\n# sr1 sends one packet and waits for one answer\n# timeout is crucial for non-blocking execution in scripts\nresp = sr1(packet, timeout=1, verbose=0)\n\nif resp:\n    print(f\"Received response from: {resp.src}\")\n    resp.show()\nelse:\n    print(\"No response received.\")\n\n# Example of sniffing packets (run for 2 packets or 5 seconds)\n# Sniffing often requires elevated privileges\ndef print_packet_summary(pkt):\n    print(pkt.summary())\n\n# sniff(prn=print_packet_summary, count=2, timeout=5)\n# print(\"Sniffing complete.\")","lang":"python","description":"This quickstart demonstrates how to import Scapy, craft a basic IP/ICMP packet, send it, and process the response. It also includes a commented-out example for sniffing packets. Sending and sniffing raw packets with Scapy typically requires root or administrator privileges. The `sr1` function sends one packet and waits for a single response, while `sniff` can capture multiple packets, using a callback function for processing."},"warnings":[{"fix":"Review code using `StreamSocket` with `TCPSession(app=True)`. Consider refactoring or consulting Scapy's documentation for updated session management patterns, or using alternative methods for TCP reassembly.","message":"The behavior of `StreamSocket` has changed. `TCPSession(app=True)` should no longer be used with `StreamSocket` as custom sessions are now marked unstable. This affects TCP reassembly and other stream-related functionalities.","severity":"breaking","affected_versions":"2.6.x, 2.7.0"},{"fix":"Migrate any custom CLI configuration from `~/.scapy_startup.py` to `~/.config/scapy/startup.py`.","message":"The Scapy CLI configuration file location moved from `~/.scapy_startup.py` to `~/.config/scapy/startup.py` to align with XDG variables. Older configuration files in the old location are no longer functional.","severity":"breaking","affected_versions":"2.6.x and later"},{"fix":"Avoid using `iface=` with Layer 3 functions. For specific interface binding, configure routing tables or use Layer 2 functions where appropriate. For multicast/link-local addresses, use RFC6874-like scope identifiers (e.g., `dst=\"ff02::1%eth0\"`).","message":"Using the `iface=` argument with Layer 3 functions (`send`, `sr`, `sr1`) is deprecated due to undefined behavior. It remains valid for Layer 2 functions (`sendp`, `srp`, `srp1`).","severity":"deprecated","affected_versions":"2.6.x and later"},{"fix":"Ensure your environment uses Python 3.9 or newer for future compatibility, especially if relying on Scapy's latest features and maintenance.","message":"Scapy 2.6.x dropped support for Python 2.7. Additionally, Scapy 2.7.0 is announced as the last version to support Python 3.7 and 3.8.","severity":"breaking","affected_versions":"2.6.x (Python 2.7), 2.7.0 (Python 3.7, 3.8)"},{"fix":"Run Scapy scripts or the interactive shell with `sudo` on Linux/macOS or as an administrator on Windows. Be mindful of the security implications when running with elevated privileges.","message":"Scapy often requires root or administrator privileges to send and sniff raw packets, as it interacts directly with network interfaces at a low level.","severity":"gotcha","affected_versions":"All versions"},{"fix":"When performing offline analysis or working in sensitive environments, be aware of Scapy's default behaviors. Explicitly configure `conf.verb = 0` to suppress verbose output and potentially limit active network interactions, and carefully review documentation for functions that may trigger live traffic.","message":"Scapy might eagerly send real packets to resolve names or perform other network interactions, even when intended for offline analysis. This can lead to unintended network activity.","severity":"gotcha","affected_versions":"All versions"}],"env_vars":null,"last_verified":"2026-04-09T00:00:00.000Z","next_check":"2026-07-08T00:00:00.000Z"}