Are you happy with your logging solution? Would you help us out by taking a 30-second survey? Click here


Scapy: the python-based interactive packet manipulation program & library. Supports Python 2 & Python 3.

Subscribe to updates I use scapy

Statistics on scapy

Number of watchers on Github 2164
Number of open issues 64
Average time to close an issue 5 days
Main language Python
Average time to merge a PR 3 days
Open pull requests 152+
Closed pull requests 74+
Last commit over 1 year ago
Repo Created almost 4 years ago
Repo Last Updated over 1 year ago
Size 68.8 MB
Homepage http://www.secdev...
Organization / Authorsecdev
Page Updated
Do you use scapy? Leave a review!
View open issues (64)
View scapy activity
View on github
Fresh, new opensource launches 🚀🚀🚀
Trendy new open source projects in your inbox! View examples

Subscribe to our mailing list

Evaluating scapy for your project? Score Explanation
Commits Score (?)
Issues & PR Score (?)


Travis Build Status AppVeyor Build Status Codecov Status PyPI Version Python Versions License: GPL v2 Join the chat at

Scapy is a powerful Python-based interactive packet manipulation program and library.

It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, store or read them using pcap files, match requests and replies, and much more. It is designed to allow fast packet prototyping by using default values that work.

It can easily handle most classical tasks like scanning, tracerouting, probing, unit tests, attacks or network discovery (it can replace hping, 85% of nmap, arpspoof, arp-sk, arping, tcpdump, wireshark, p0f, etc.). It also performs very well at a lot of other specific tasks that most other tools can't handle, like sending invalid frames, injecting your own 802.11 frames, combining techniques (VLAN hopping+ARP cache poisoning, VoIP decoding on WEP protected channel, ...), etc.

Scapy supports Python 2.7 and Python 3 (3.3 to 3.6). It's intended to be cross platform, and runs on many different platforms (Linux, OSX, *BSD, and Windows).


Interactive shell

Scapy can easily be used as an interactive shell to interact with the network. The following example shows how to send an ICMP Echo Request message to, then display the reply source IP address:

sudo ./run_scapy 
Welcome to Scapy
>>> p = IP(dst="")/ICMP()
>>> r = sr1(p)
Begin emission:
.Finished to send 1 packets.
Received 2 packets, got 1 answers, remaining 0 packets
>>> r[IP].src

Python module

It is straightforward to use Scapy as a regular Python module, for example to check if a TCP port is opened. First, save the following code in a file names

from scapy.all import *
conf.verb = 0

p = IP(dst="")/TCP()
r = sr1(p)

Then, launch the script with:

sudo python
IP / TCP > SA / Padding


To begin with Scapy, you should check the notebook hands-on and the interactive tutorial. If you want to learn more, see the quick demo: an interactive session (some examples may be outdated), or play with the HTTP/2 and TLS notebooks.

The documentation contains more advanced use cases, and examples.


Scapy works without any external Python modules on Linux and BSD like operating systems. On Windows, you need to install some mandatory dependencies as described in the documentation.

On most systems, using Scapy is as simple as running the following commands:

git clone
cd scapy

To benefit from all Scapy features, such as plotting, you might want to install Python modules, such as matplotlib or cryptography. See the documentation and follow the instructions to install them.


Want to contribute? Great! Please take a few minutes to read this!

scapy open issues Ask a question     (View All Issues)
  • almost 3 years I have a about the conf.route problem install scapy in Windows
  • almost 3 years RFC error (from stack over flow)
  • almost 3 years pdfdump failed when conf.prog.pdfreader not exists
  • almost 3 years MPLS EOS Guessing payload
  • almost 3 years Which field type could be used
  • almost 3 years The "stop_filter" of sniff() is missing ?
  • almost 3 years BytesIO Support for Pcap Export
  • almost 3 years Scapy can't be used without winpcap
  • almost 3 years Windows Links for Python 2.7
  • almost 3 years Travis fails on OS X with pcap & dnet modules
  • almost 3 years Support for nested MPLS labels.
  • almost 3 years Encryption and Decryption
  • almost 3 years IP.route() does not choose correct source IP when there are interface aliases
  • almost 3 years Unsupported address family for interface teredo
  • about 3 years ICMPv6NDOptIPAddr dissector fail at Solaris
  • about 3 years Still have PicklingError issue when save_session
  • about 3 years GTP fields manipulation
  • about 3 years too long request body cannot sniff all, some body lost
  • about 3 years How to improve slow performance, poor speedup with pypy
  • about 3 years Command "python egg_info" failed with error code 1 in /private/tmp/pip-build-p9nki1_9/scapy/
  • about 3 years Replace PyCrypto by cryptography
  • about 3 years StreamSocket issue with SSL-wrapped sockets
  • about 3 years Fuzzing scapy with python-afl
  • about 3 years sniff() is broken
  • about 3 years Nanosecond libpcap
  • about 3 years Cannot Open BluetoothUserSocket After Opening/Closing One Beforehand
  • about 3 years Scapy.sniff() on Windows missing stop_filter and opened_socket arguments
  • over 3 years TCP checksum computation function
  • over 3 years FlagsField flag test expression
  • over 3 years Is there a place to see what is the current roadmap?
scapy open pull requests (View All Pulls)
  • Multiple ASN.1 enhancements ; X.509 comprehensive support
  • A proof of concept of BGP-4 with less ConditionalFields
  • add TCP User Timeout Option (RFC 5482)
  • Allow L2pcapListenSocket to return None if where is no packets (issue #74)
  • Sniff can accept a list of interfaces (+ fixed bug)
  • PacketList.conversations(): add labels, support ARP by default
  • Fixes crash when an interface has no ip
  • GTP improvements
  • Modifications / Recommendations
  • New read_routes6() function and unit tests
  • Check read_routes6() output
  • Add reserved and user-defined function support
  • Support for Diameter protocol layer (base RFC6733 + extensions)
  • Workaround to ignore interfaces whose name got truncated by netstat
  • In add a "dump" argument to return the packet representation
  • Add Segment Routing Header (IPv6 extensions header) according to
  • Run unit tests on Linux and OS X - root and non-root
  • improvements
  • TCP Fast Open support
  • layers/ Added New Packets and Bug Fix
  • In show() and show2() add the "dump" argument to return the packet representation
  • mDNS support
  • Stop sniff() on empty s.recv()
  • OS X installation methods updated
  • Import missing & mixup of psm status/result values in #189
  • 'packages' list in has been updated.
  • Native Mac OS X and *BSD support
  • Solaris support when send/recv msg
  • Fix bugs found with python-afl in IPv6 and ASN1 BER
  • Add DCE/RPC layer
  • Add PROFINET IO real-time layer
  • layers/ipsec: fix padding problems with fuzzed packets
  • Add SSLStreamSocket
  • IGMP V3 report PDU implementation
  • Packet::getlayer() behavior change.
  • NSH: first implementation and small update
  • enhance version management
  • Corrected ICV length for AES-GCM and AES-CCM in IPSec layer. Added un…
  • Useless 'as' keyword breaks Python 2.5 compatibility
  • Fixed a bug in the sendrecv method when using multi-threading
  • Fixed some Windows crashes (arch + tests)
  • Choose correct source IP when there are interface aliases
  • Travis fails on OS X with pcap & dnet modules
  • add new protocol and test 'OPC DA'
  • Fixed windows circular import
  • Add TLS support
  • Added Authentication payload type
  • fix some error for windows
  • [] Add support for some SubTLVs
  • Adding an EditorConfig file
  • Fix ICMPv6MLQuery().hashret()
  • improve installation doc regarding OpenBSD
  • Fixed the invalid copy_flag in some ip options
  • ASN.1 enhancements
  • [README] brew is not recommended to be run as sudo
  • UDP checksum computation fixed
  • Use socket.pton & socket.ntop is available
  • use the BSD code path on OpenBSD too
  • OS X Travis tests fixed
  • Fix & improve source fields
  • [Windows] Fix AutoCompletion + add tests
  • [coverage] VRRP, L2TP, HSRP, RIP, & Radius tests
  • [coverage] AS resolvers tests
  • Improvement of the GTPv1 support.
  • Attempt to set Packet.explicit to True as often as possible
  • EAPOL-MKA (MACsec Key Agreement protocol) support.
  • dot11 ack frame dissection
  • Rewrite of ProfinetIO and ProfinetIO RTC
  • Add callbacks to EnumFields for large ranges
  • Add next_cls_cb attribute to PacketListField
  • Fix issue #408 : complex ASN1 fields randval()
  • Fix issue #359: Bin to str conversion of IPv6 addresses
  • Fix IA_PD length error
  • [coverage] More unit tests for scapy/*.py files
  • BGP module update.
  • [DOCS] Installation + Links fixed (Windows)
  • New protocol OPC-DA and update for modbus
  • Cache fields initialization
  • [convergence] map() calls rewritten as list comprehensions
  • [Pipetools/coverage] Make pipes work on windows + add tests
  • Added support for MQTT protocol
  • [coverage] New tests + simplify construct_source_candidate_set
  • [Python 2 to 3] Fix overwritten imports (small)
  • [Python 2 to 3] Main six fixes
  • [Python 2 to 3] Exceptions, loops, isinstance and haskey
  • RADIUS module update.
  • [Windows/coverage] Support sndrcvflood on Windows +
  • Improve PPP Authentication support
  • [Windows] Add pcap service controller
  • Work on pipes
  • Support for Diameter protocol layer (base RFC6733 + extensions)
  • [convergence] Python 3- Step 3: Main core fixes
  • [Deprecated PR] Python 3- Step 2: Auto-code migration
  • basic EtherCat layer
  • [TLS] Major module overhaul
  • Parse MPLS in MPLS Payload
  • [Contrib] Add Authentication payload type to IKEv2
  • MPLS label layering/stacking clears the EOS bit
  • Unify IPv4 and IPv6 prefix treatment
  • Fix typo in troubleshooting.rst
  • Unify IPv4 and IPv6 NLRI code and allow '0/0' notation for IPv4 default
  • [General] Update licenses & Contrib flags
  • SEND module fixes & Stuff
  • UTscapy: stop on first error parameter
  • BIER support (from…
  • add support for encapsulating Ethernet frame in MPLS
  • Missing contrib test
  • Fix PR 947: Delay Tolerant Networking Protocols
  • Add LACP module to contrib
  • Tazmen sniffer protocol layer
  • Fix read routes catch ioctl error #957
  • Add layers for Delay Tolerant Networking Protocols
  • [coverage] OSPF: add tests + Code cleanup
  • Fix netflow v9
  • Added IPv6 and IPv4/IPv6 support to GTP
  • [UTscapy] allow interrupting tests
  • Linting and cleaning
  • Sending/Recieving: Improve speed
  • Scapy 2.4, Windows: Replace some obvious vbs/csript code with pure Python equivalent (part1).
  • [oneline] Print IPs correctly
  • Fix
  • Fix routes generators #1135
  • fix backward incompatibility of scapy.utils.RawPcapReader.read_packet() for scapy's v2.4 againts v2.3.2 & v2.3.3
  • [WIP] Select default opener
  • Isis changes for rfc5305
  • Logs: remove duplicated
  • CAN layer progress
  • Add a new parameter interpkt_timeout to the sniff function
  • Adding IEEE 802.15.4 Layer
  • Add BlockAck Request subtype for addr2 conditional field clause
  • Added IPv6 and IPv4/IPv6 support to GTPv1
  • IPv6 use conf.iface when selecting the source link-local address
  • NIQ fixes
  • MLDv2 support
  • [WIP] Switch Linux Travis test to tox
  • IPv6 attack tests
  • Issue and pr templates #1153
  • Fix lldp org specific dissection clean #1151
  • add mac control layer #976
  • Scapy 2.4, Windows: fix for 'IFACES' backward incompatibility with scapy v.2.3.2
  • add IEC 60870-5-104 layer
  • Scapy 2.4.0rc5-40: Little but obvious code improvements
  • Scapy 2.4.0: fix a bug in 'snmpwalk()'
  • Fix handle inheritance for Python2 (more appropriate and safe version of #1138 hack, fixes #1136)
  • Rename test keywords.
  • LLDP: support complex ID types
  • handle padding and fix building of CAN packets
  • Add support for Geneve per IETF draft draft-ietf-nvo3-geneve-06
  • 801.11 monitor mode for OSX
  • Minor change to the internal structure of CAN packet implementation
  • [fix] id in LLDPDUChassisID was from type XStrLenField but this seems…
scapy questions on Stackoverflow (View All Questions)
  • using nfqueue in python with scapy to inspect packets - scapy defragment function puts the tcp header in the Raw layer
  • Python Scapy / operator, | pipe in types
  • Converting a sniffed scapy packet to bytes
  • Python 2.7 + Scapy 2.3.1
  • Cannot import Scapy ssl_tls library
  • Scapy - send packets from pcap file with changed ip addresses
  • Add ttl field in scapy
  • scapy 3-way hand shake not work
  • Getting source IP of packet using Scapy
  • Installing and running Scapy on Windows
  • Error when trying to run scapy shell
  • Wireshark and Scapy sniffs only ARP packets (one packet in 3 minutes), what to do?
  • DNS server using python and scapy
  • Scapy python dns request
  • Multiprocessing on Scapy
  • Put domain in rdata of Packet - Scapy , python
  • Scapy could't send packet over linux tap device
  • Downloading file/webpage in scapy
  • Importing scapy to blender
  • Scapy beacon frame corrupt?
  • Running Scapy on Windows with Python 2.7
  • Cannot find Ether class from scapy module
  • Installing python libdnet (to install scapy)
  • How to send multiple packets in scapy
  • Scapy OSError when importing scapy.all: 'wpcap.dll' does not exsist
  • Scapy installation fails due to invalid token
  • Tcp Sygment size on scapy
  • Scapy sr1 function without outputs
  • Scapy: Using a PacketListField to dissect multiple packets contained in a packet
  • How to build a CoAP packet using scapy
scapy list of languages used
Other projects in Python