SCAPY(1)

📦
version 2.7.0 · 4 versions
, in ubuntu resolute, ubuntu stonking

🦋 SCAPY(1) — the girlies' guide to packet manipulation 🦋

okay bestie, welcome to scapy(1) from the General Commands Manual — this is the page for the Scapy tool and it is lowkey iconic, highkey powerful, and fr fr one of my faves. sit down, grab a strawberry, we're doing packets today. 🍓✨

✨ NAME ✨

scapy — interactive packet manipulation tool 💅

🌸 SYNOPSIS 🌸

scapy [options]

that's it. that's the whole vibe. 🎀

💖 DESCRIPTION 💖

This manual page documents briefly the Scapy tool. (briefly!! because there's so much more, iykyk.)

Scapy is a powerful interactive packet manipulation tool, packet generator, network scanner, network discovery, packet sniffer, etc. And the way that it can, for the moment, replace hping, parts of nmap, arpspoof, arp-sk, arping, tcpdump, tshark, p0f, ... — like, the whole roster. not me casually replacing your entire toolbelt. 💀

Scapy uses the Python interpreter as a command board. Which means you can use the Python language directly — assign variables, use loops, define functions, etc. you're literally in Python, bestie. it's giving "I have a REPL and I'm not afraid to use it". 🔥

The idea is simple. Those kinds of tools do two things: sending packets and receiving answers. That's what Scapy does: you define a set of packets, it sends them, receives answers, matches requests with answers, and returns a list of packet couples (request, answer) and a list of unmatched packets. This has the big advantage over tools like nmap or hping that an answer is not reduced to (open/closed/filtered) — it's the whole packet. PERIODT. 👑

On top of this can be used to build more high-level functions, for example:

  • one that does traceroutes and gives as a result only the start TTL of the request and the source IP of the answer
  • one that pings a whole network and gives the list of machines answering
  • one that does a portscan and returns a LaTeX report 📄✨

like ma'am?? a LaTeX report?? obsessed.

✨ OPTIONS ✨

Options for Scapy are:

  • -h — display usage 🫶
  • -H — header-less mode, also reduces verbosity. (quiet mode, she's shy)
  • -d — increase log verbosity. Can be used many times. (stack it like your iced coffees ☕)
  • -p PRESTART_FILE — use PRESTART_FILE instead of $HOME/.config/scapy/prestart.py as pre-startup file
  • -P — do not run prestart file 🚫
  • -c STARTUP_FILE — use STARTUP_FILE instead of $HOME/.config/scapy/startup.py as startup file
  • -C — do not run startup file 🚫

🎀 COMMANDS 🎀

Only the vital commands to begin are listed here for the moment. (for the moment!! there's more coming, girlies, stay tuned.)

  • ls() — lists supported protocol layers. If a protocol layer is given as parameter, lists its fields and types of fields. If a string is given as parameter, it is used to filter the layers. 🌈
  • lsc() — lists scapy's main user commands. 📜
  • conf — this object contains the configuration. ⚙️

🧚 FILES 🧚

  • $HOME/.config/scapy/prestart.py — This file is run before Scapy core is loaded. Only the conf object is available. This file can be used to configure the CLI, configure parameters such as the conf.load_layers list to choose which layers will be loaded, or change the logging level (for instance):
conf.interactive_shell = "bpython"
log_loading.setLevel(logging.WARNING)
conf.load_layers.remove("bluetooth")
conf.load_layers.append("new_layer")
  • $HOME/.config/scapy/startup.py — This file is run after Scapy is loaded. It can be used to configure more of Scapy behaviors, like un-registering layers:
conf.prog.pdfreader = "xpdf"
split_layers(UDP,DNS)

🌟 EXAMPLES 🌟

More verbose examples are available in the documentation at https://scapy.readthedocs.io/. Just run scapy and try the following commands in the interpreter. 🫶

Test the robustness of a network stack with invalid packets:

sr(IP(dst="172.16.1.1", ihl=2, options=["verb$2"], version=3)/ICMP(), timeout=2)

Packet sniffing and dissection (with a bpf filter or tshark-like output):

a=sniff(filter="tcp port 110")
a=sniff(prn = lambda x: x.show)

Sniffed packet re-emission:

a=sniff(filter="tcp port 110")
sendp(a)

Pcap file packet re-emission:

sendp(rdpcap("file.cap"))

Manual TCP traceroute:

sr(IP(dst="www.google.com", ttl=(1,30))/TCP(seq=RandInt(), sport=RandShort(), dport=dport)

Protocol scan:

sr(IP(dst="172.16.1.28", proto=(1,254)))

ARP ping:

srp(Ether(dst="ff:ff:ff:ff:ff:ff")/ARP(pdst="172.16.1.1/24"))

ACK scan:

sr(IP(dst="172.16.1.28")/TCP(dport=(1,1024), flags="A"))

Passive OS fingerprinting:

sniff(prn=prnp0f)

Active OS fingerprinting:

nmap_fp("172.16.1.232")

ARP cache poisoning:

sendp(Ether(dst=tmac)/ARP(op="who-has", psrc=victim, pdst=target))

Reporting:

report_ports("192.168.2.34", (20,30))

🌈 SEE ALSO 🌈

💀 BUGS 💀

ngl bestie, she's not perfect and we're gonna be honest about it:

  • Does not give the right source IP for routes that use interface aliases. 🙈
  • May miss packets under heavy load. This is a restriction from python itself. 😭
  • Session saving is limited by Python ability to marshal objects. As a consequence, lambda functions and generators can't be saved, which seriously reduce the usefulness of this feature. 💀
  • BPF filters don't work on Point-to-point interfaces. 🚫

👑 AUTHOR 👑

Philippe Biondi and the Scapy community. 🫶

and that's the whole page, bestie!! this manual page is from March 24, 2024, SCAPY(1), and it's the one and only scapy(1) — slay, go send some packets, and remember: every answer is the whole packet, not just open/closed/filtered. main character energy only. 💅✨🎀

📦 where this page comes from