secdev/scapy
Scapy
Scapy is a network packet manipulation tool and protocol analysis suite designed for crafting, sending, sniffing, and dissecting network traffic. It functions as a framework for building custom network tools that interact directly with low-level packet headers and payloads, enabling users to perform security research and network diagnostics.
The system distinguishes itself through a layer-based construction model that allows users to define protocols as stacked objects, which automatically handle checksums and field offsets. It utilizes dynamic field reflection to map packet structures to binary data formats and employs a raw socket interface to bypass standard transport layer restrictions for custom packet injection.
The platform provides a comprehensive capability set for network security testing, automated scanning, and traffic simulation. It includes a protocol dissection engine that recursively parses binary streams into structured objects, supported by stateful flow tracking to correlate packets into logical sessions. Users can capture and analyze live traffic through a background sniffing loop to troubleshoot communication patterns and verify protocol implementations.
Features
- Custom Network Protocols - Provides a toolkit for building custom network tools that interact with low-level packet headers and payloads.
- Packet Analysis Tools - Serves as a comprehensive library for crafting, sending, sniffing, and dissecting network packets.
- Network Traffic Analyzers - Captures and inspects live network traffic to troubleshoot communication patterns and protocol implementations.
- Packet Construction - Allows crafting and sending custom network packets for connectivity testing and security research.
- Security Testing - Facilitates network security testing by crafting custom packets to probe for vulnerabilities.
- Packet Inspection - Offers a framework for capturing and inspecting live network traffic to verify security protocol implementations.
- Dissection Engines - Provides a recursive engine for parsing binary network streams into structured objects.
- Network Protocol Implementations - Provides tools for decoding and analyzing raw network traffic to troubleshoot connectivity.
- Network Scanning Tools - Enables automated network scanning to discover hosts and identify open ports via custom probes.
- Network Virtualization - Packet manipulation and network analysis library.
- Automotive Development Libraries - Packet manipulation library with support for automotive protocols.
- Language Specific Libraries - Library for sending, receiving, and editing raw network packets.
- IoT Protocol Security - Powerful packet manipulation library for network protocol analysis.
- Traffic Manipulation - Python library for interactive packet manipulation.
- Network Traffic Processors - Generates synthetic network traffic to test application and infrastructure resilience against specific data loads.
- Packet Capture Engines - Implements a background sniffing loop for capturing and dissecting raw network traffic.
- Socket Interfaces - Provides direct access to raw sockets for custom packet injection and network stack interaction.
- Flow Tracking Engines - Maintains internal tables to correlate network packets into logical sessions for analysis.
