Scapy

Misc infos about Scapy

Scapy is a packet manipulation tool written in Python.

I'm neither the author nor the maintainer of this tool, and this is not the official page of Scapy. This page only provides new patches that are not integrated in Scapy and a few comments about it.

You should start by reading the Scapy official page, and download the work-in-progress version.

Tools & patches

Once again, the patches on this page are not included in Scapy, so don't bother the author if they don't work / are broken / whatever. Instead, contact me.

Scapext

Here is an extension, which adds some stuffs I need in scapy and not (yet) included in scapy. This in something like my experimental scapy playground. Contributions, questions and remarks are of course welcome.

The content of this extension often changes, based on things included in scapy and based on my new needs / tests. For now :

• GeoIP support (through Maxmind's GeoIP Python API). You can then use (at least) GeoLite Country and GeoLite City (use conf.GeoIP_country and conf.GeoIP_city). This provides, for now, host2coords and host2country, and an updated version of TracerouteResult.world_trace.
• ASN resolution (taken from scapy.py:TracerouteResult.makegraph, with nothing added ; might be usefull in other places).
• PFLog pcap type (used by the OpenBSD Packet Filter to log packets ; this allows PF to store valuable information on what happened to the packets logged). See ticket #7.
• Early and experimental SunRPC support with state handling (needed to know what application a response concerns, since this is only shown in the call, not in the response). See this post on Scapy ML.

Scapereal

A nice (!) tool : Scapereal is an ethereal-like packet list viewer for Scapy. Download it, run Scapy as usual, and type : ">>> from scapereal import *". You can now use "ethereal(pl)", where "pl" is a PacketList. You'll need PyGTK to use it.

*BSD / MacOS

Scapy now runs under FreeBSD and MacOS X. It has been successfully tested under MacOS X 'Tiger' with the Python shipped with the 'developer tools' ; I only had to add the readline.so (for example, you can just gunzip this one and move it to your 'site-packages' directory).

If you plan to run Scapy under *BSD / MacOS, may-be this doc could be usefull.

Latest update on Dec 8, 2006.