Scapy Usage part 2

Some more usage of SCAPY

Capturing file and writing to PCAP and reading PCAP files for analysis

>>> pkts=sniff(count=10)
>>> wrpcap(‘traffic.pcap’,pkts)        Write list of packets to PCAP file
>>> packetlist = rdpcap(‘traffic.pcap’) Read PCAP file into list of packets
>>> for pkt in pkts:
… print pkt.src, pkt.type

00:0c:29:01:22:43 2054
00:0c:29:eb:a4:2f 2054
00:0c:29:01:22:43 2048
00:0c:29:eb:a4:2f 2048

Saving the Traffic patten in a graph

>>> res,unans = traceroute ([“”,””,””,””,””],dport=[80,443],maxttl=20,retry=-2)
Received 190 packets, got 190 answers, remaining 10 packets 207.46…
1 192.16…
2 82.251…
3 213.22…
>>> res.graph() # piped to ImageMagick’s display program.
>>> res.graph(type=”ps”,target=”| lp”) # piped to postscript printer
>>> res.graph(target=”> /tmp/graph.svg”) # saved to file

>>> res.trace3D()        #in 3d if VPython available.

When we have multiple interfaces and want to send packets on a specific interface

>>send(pkt, iface=”eth0″)
>>sendp(eth/ippkt/tcppkt, iface=”eth0″)

Replay an attack from packet capture

>>>for pkt in pkts:
>>> send(pkt)

Monitor ARP Packet for anything


from scapy.all import *
def arp_mon(pkt):
if ARP in pkt and pkt[ARP].op in (1,2):
print pkt[ARP].hwsrc,pkt[ARP].psrcsniff(prn=arp_mon,filter=”arp”,count=4)

root@bt:~# python
WARNING: No route found for IPv6 destination :: (no default route?)

CONFIGURATION params of scapy

we can edit these parameters customized to our need like
editing iface [Interface]
promisc = 1 [promiscious mode]


MORE Info: Scapy Documentation include various functions for reference.LINK


About wikihead

A security freak
This entry was posted in Articles, Notes, security, Uncategorized and tagged , . Bookmark the permalink.

2 Responses to Scapy Usage part 2

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s