scapy

What it is and what it does

Scapy is a packet manipulation library that lets you construct, send, capture, and analyze network packets at a low level. It supports a wide range of protocols and can be used interactively as a shell or imported as a library in Python scripts. The library handles classical network tasks like scanning, tracerouting, and probing, but also excels at specialized work such as crafting malformed frames, injecting 802.11 packets, and combining advanced techniques like VLAN hopping or ARP cache poisoning.

The package has no required runtime dependencies and works on Linux, BSD, macOS, and Windows (with platform-specific setup). It requires Python 3.7 or later and is actively maintained. Most operations require root or administrator privileges to access raw sockets. Optional features like plotting or cryptography support can be added by installing additional packages separately.

Use it for:

• Build custom network scanning and reconnaissance tools that go beyond standard utilities.
• Develop unit tests and integration tests for network protocol implementations and behavior.
• Analyze and decode captured network traffic from pcap files for security research or troubleshooting.
• Craft and send non-standard or malformed packets to test network device robustness and security.
• Prototype network attack or defense techniques in a controlled, interactive environment.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Scapy is a Python library for forging, decoding, sending, and capturing network packets across many protocols, enabling interactive packet manipulation and network analysis tasks.

Yes, if you need low-level packet manipulation and network analysis. Scapy is production-stable, actively maintained, has no required dependencies, and is widely used for security research and network engineering. However, the GPL-2.0 copyleft license is a hard blocker for proprietary software, and you must have root/administrator access to use packet capture and injection features. Evaluate the license constraint first.

Install

scapy on PyPI

pip install scapy

uv add scapy

poetry add scapy

Installing scapy

Before you install

Installation is straightforward with no runtime Python dependencies. The project is actively maintained with recent commits and a large repository following, making it a stable choice for production use.

License in practice

Scapy is licensed under GPL-2.0-only (copyleft). Any derivative work or distribution must also be released under GPL-2.0, and source code must be made available to users. This is a significant constraint for proprietary or closed-source projects.

Quickstart

pip install scapy

from scapy.all import IP, ICMP, sr1
p = IP(dst="example.com")/ICMP()
r = sr1(p)

Requires root/administrator privileges to send and receive raw packets on most systems. On Windows, additional system dependencies must be installed as documented.

Verify before relying

• Whether the package's cross-platform support (Linux, OSX, BSD, Windows) is equally mature on all platforms.
• Performance characteristics when handling high-volume packet streams or very large pcap files.
• Current state of optional feature modules (plotting, cryptography integration) and their maintenance status.

Package facts

Evidence: scapy-2.7.0-py3-none-any.whl

Keywords: network

Tags

More Security packages