R-SCA
Scapy
Python library and interactive shell for crafting, sending, and dissecting arbitrary network packets.
OVERVIEW
Scapy (github.com/secdev/scapy) is a Python library and interactive shell that lets you build a network packet field by field, at any layer from Ethernet up through application-layer protocols, then send it, sniff for a reply, or feed it into a script for a repeatable test. Where Nmap or a scanner answers a fixed set of questions, Scapy answers whatever question you can express in Python: a TCP handshake with unusual flags, a DNS query with a crafted transaction ID, an ARP request to map a local segment.
Because it's a library rather than a single-purpose binary, it also doubles as a packet-analysis and fuzzing toolkit: it can read and rewrite pcap files, decode a capture layer by layer in the interactive shell, or drive a fuzzing loop that mutates a base packet and watches how a target responds.
USE CASES
Practical use cases
- 01
Crafting non-standard or malformed packets to test how a target device or IDS handles edge cases.
- 02
Scripting a custom protocol probe when no existing tool speaks the service in question.
- 03
Sniffing and dissecting traffic on a local segment to understand an unfamiliar protocol.
- 04
Automating packet-level checks (ARP spoofing detection, TCP sequence prediction) as part of a network assessment.
QUICK START
When a scanner's built-in checks aren't enough and you need to build or manipulate a packet by hand — custom protocol fields, malformed headers, or a one-off probe.
- Confirm packet crafting/injection against the target network is inside the authorized scope.
- Install Scapy with pip inside a virtual environment (root/admin privileges are needed for raw sockets).
- Launch the interactive shell to build and send a first packet, or import scapy.all in a script.
- Use sniff() or sr()/sr1() to capture responses and confirm the target's actual behavior.
- Save the interaction as a reusable script or pcap for the report.
python3 -c "from scapy.all import *; send(IP(dst='10.10.10.5')/ICMP())"BEFORE YOU RUN IT
What to check before running it
Crafting and injecting raw packets requires root/admin privileges and can trigger IDS/IPS alerts or trip rate-limiting on fragile network gear — confirm scope and timing before running scripts at volume.
Malformed or fuzzed packets can crash legacy embedded devices (printers, ICS/OT equipment, older switches) rather than just log an alert — treat fuzzing against production infrastructure as a DoS risk and get explicit sign-off.
Scapy is a building block, not a finished scanner: its output is only as reliable as the script you write, so peer-review custom probes before relying on their results in a report.