Scapy
lastmod 2025-04-23created 2019-12-068 edits
Scapy is a powerful interactive packet manipulation library written in Python. Scapy is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more.
About
Scapy is a Python program that can send, sniff, or forge network packets. These capabilities let you inspect, scan, or attack a network. In other words, Scapy is a very powerful packet manipulation program.
Seems to be GPL-licensed.
Stripping tcpdump payload
from scapy.all import *
INFILE = 'sample.pcap'
OUTFILE = 'stripped.pcap'
paks = rdpcap(INFILE)
for pak in paks:
pak[TCP].remove_payload()
wrpcap(OUTFILE, paks)
Replaying PCAP files
You can replay a PCAP file to reproduce network traffic.
from scapy.all import rdpcap, sendp
packets = rdpcap("example.pcap")
for packet in packets:
sendp(packet)
Network Mesh Drawing
Install the libraries:
- scapy - network scanning tool
- networkx - library for building graphs
- matplotlib - visualization
Find neighboring devices with a network scan:
from scapy.all import ARP, Ether, srp
def scan_network(ip_range="192.168.1.0/24"):
"""현재 네트워크의 IP 대역에서 장치를 탐색합니다."""
arp = ARP(pdst=ip_range)
ether = Ether(dst="ff:ff:ff:ff:ff:ff")
packet = ether / arp
result = srp(packet, timeout=2, verbose=0)[0]
devices = []
for sent, received in result:
devices.append({'ip': received.psrc, 'mac': received.hwsrc})
return devices
Build and visualize the mesh graph:
import networkx as nx
import matplotlib.pyplot as plt
def draw_mesh(devices):
G = nx.Graph()
for device in devices:
G.add_node(device['ip'])
# Mesh 연결: 모든 노드를 서로 연결
for i in range(len(devices)):
for j in range(i + 1, len(devices)):
G.add_edge(devices[i]['ip'], devices[j]['ip'])
plt.figure(figsize=(10, 8))
nx.draw_networkx(G, with_labels=True, node_color='skyblue', node_size=1500, font_size=10)
plt.title("Network Mesh Graph")
plt.axis("off")
plt.show()
Example run:
if __name__ == "__main__":
devices = scan_network("192.168.0.0/24") # 본인 IP 대역 확인 필요
draw_mesh(devices)
- ARP scanning with scapy may require sudo privileges.
- Depending on the firewall, some devices may not be detected.