Installing Python and Scapy
Scapy was originally written for Python 2, but since the 2.4 release (March 2018), you can now use Scapy with Python 3.4+! I will prefer Python 3 in examples but will also include notes about big differences between each python version and Scapy if they exist.
If you're using a Mac or running some version of *nix you probably already have Python 2 (and maybe even Python 3) installed. To check, open a terminal and type
python. You should see something like this:
localhost:~ packetgeek$ python3 Python 3.7.2 (v3.7.2:9a3ffc0492, Dec 24 2018, 02:44:43) [Clang 6.0 (clang-600.0.57)] on darwin Type "help", "copyright", "credits" or "license" for more information. >>>
If you are running Windows or for some other reason do not have Python installed already, go to the Python download page and grab the installer for your platform.
There are multiple ways to install Scapy depending on your platform. Check out the Scapy installation guides to find instructions and installer packages relevant to your platform. Once Scapy is installed, you should be able to run it from the terminal, just like we did with Python, and get something that looks like this:
localhost:~ packetgeek$ scapy aSPY//YASa apyyyyCY//////////YCa | sY//////YSpcs scpCY//Pp | Welcome to Scapy ayp ayyyyyyySCP//Pp syY//C | Version 2.4.2 AYAsAYYYYYYYY///Ps cY//S | pCCCCY//p cSSps y//Y | https://github.com/secdev/scapy SPPPP///a pP///AC//Y | A//A cyP////C | Have fun! p///Ac sC///a | P////YCpc A//A | We are in France, we say Skappee. scccccp///pSP///p p//Y | OK? Merci. sY/////////y caa S//P | -- Sebastien Chabal cayCyayP//Ya pY/Ya | sY/PsY////YCc aC//Yp sc sccaCY//PCypaapyCP//YSs spCPY//////YPSps ccaacs using IPython 7.2.0 >>>
I highly recommend install IPython in your scapy environment as it makes interactive mode much more enjoyable!
pip3 install ipython
Scapy and Network Interfaces
If you have multiple network interfaces on your computer, you might have to double check which interface Scapy will use by default. Run
scapy from the terminal and run the
conf command. See what interface Scapy will use by default by looking at the
localhost:~ packetgeek$ scapy Welcome to Scapy (2.4.3) >>> conf.iface 'en0'
Scapy on my computer is defaulted to my en0 (Wifi) interface
If the default interface is not the one you will use, you can change the value like this:
*Instead of en3, use the interface you want to be your default
If you are constantly switching back and forth between interfaces, you can specify the interface to use when you run Scapy commands. Here are some Scapy functions and how you might use the
iface argument. You'll learn more about these functions and other arguments soon.
>>> sniff(count=10, iface="en3") >>> send(pkt, iface="en3")
For some of the Scapy functions dealing with sending traffic, you will need to be able to run Scapy as root. For example, on a Mac/Linux computer you can run interactive mode with root permissions by running
sudo scapy from the CLI. Also, you can run the Python scripts with Scapy send functions as sudo like this:
$ sudo python3 script.py
If you ever receive a Python error about not having the correct permissions or something not be allowed, try running Scapy with root permissions.