Packet Sniffing and Manipulation with Python Scapy

Scapy is a versatile, Python-based network tool that enables security professionals and developers to interact directly with network traffic at granular levels. This article provides a focused breakdown of Scapy's core capabilities, specifically covering how it captures packets using targeted filters, constructs and alters network layers on demand, transmits custom traffic, and automates advanced network operations such as reconnaissance and protocol fuzzing.

Packet Sniffing and Filtering

Scapy captures network traffic using its native sniff() function, which interfaces directly with the host's network sockets. Traffic capture can be tailored using several parameters:

• Berkeley Packet Filters (BPF): Scapy supports standard BPF syntax via the filter argument, allowing users to isolate specific traffic (e.g., filter="tcp and port 80") before Scapy processes it, significantly reducing memory consumption.
• Packet Processing Callbacks: The prn argument accepts custom Python functions to process each arriving packet in real time. For example, a callback can extract credentials, log specific header fields, or trigger alerts.
• Offline PCAP Analysis: In addition to live interfaces, Scapy can sniff and parse stored capture files using rdpcap() and write captures using wrpcap(), enabling automated post-incident analysis.
• Capture Thresholds: Sniffing sessions can be bounded by packet count (count), timeout limits (timeout), or custom stop conditions (stop_filter).

Packet Crafting and Layer Stacking

Unlike standard socket libraries that abstract lower layers, Scapy provides direct access to virtually every standard networking protocol (Ethernet, ARP, IP, TCP, UDP, ICMP, DNS, and more).

• The Slash (/) Operator: Scapy uses Python's division operator to stack protocol layers hierarchically. Defining a packet involves chaining layers from low to high: Ether() / IP(dst="192.168.1.1") / TCP(dport=443) / "HTTP_PAYLOAD".
• Automatic Header Resolution: Undefined fields are automatically populated with sensible defaults, such as checksums, protocol numbers, and source IP addresses, while allowing users to override any field arbitrarily.
• Dissection and Fragmentation: Scapy automatically reassembles or fragments IP packets and dissects raw binary streams into readable protocol trees, facilitating deep packet inspection.

Packet Injection and Transmission

Scapy categorizes packet transmission by network layer and whether a response is expected:

• Layer 3 Transmission: The send() function dispatches packets at the Network layer (IP level), letting the operating system handle link-layer addressing. The sr() (send and receive) and sr1() (send and return first response) functions wait for answers, returning answered and unanswered packet pairs.
• Layer 2 Transmission: The sendp() and srp() functions operate at the Data Link layer, requiring explicit Ethernet or hardware addressing. This allows raw frame injection, VLAN tagging, and low-level spoofing.

Practical Network Techniques

By combining sniffing, crafting, and sending, Scapy facilitates several active networking workflows:

• SYN Scanning: Sending a TCP packet with the SYN flag set and monitoring responses (SYN-ACK for open ports, RST for closed) enables fast, stealthy port scanning without establishing full connections.
• ARP Cache Poisoning: By crafting unsolicited ARP replies (ARP(op=2)), Scapy can overwrite target ARP tables to execute on-path (Man-in-the-Middle) inspection.
• Network Mapping and Traceroute: Scapy includes a built-in traceroute() function that sends packets with incremental TTL values, mapping hops and visualizing network paths.
• Protocol Fuzzing: The fuzz() function generates randomized or malformed field values inside layered packets (e.g., IP()/TCP()/fuzz(DNS())) to test network services and firewalls for stability and edge-case handling.