Scapy

Scapy is a Python packet toolkit for building, sending, capturing and decoding network traffic. It is best for developers, administrators and researchers who need to shape probes rather than use fixed-purpose utilities. Its flexibility is compelling, but it expects Python and protocol fluency.

Overview

Scapy combines packet manipulation with an interactive shell and a Python library. Users can assign arbitrary field values and stack protocol layers without being constrained to preset templates. That makes it useful when a probe or packet needs to be tailored closely; it is less suitable for readers who want a guided analyzer to interpret traffic for them.

Its scope includes scanning, tracerouting, probing, network discovery, unit tests and attacks. Scapy returns complete decoded packets after a probe, before imposing an interpretation. That preserves analytical freedom, but also leaves users responsible for making sense of the results.

Key features

Scapy can forge and decode packets, send and capture traffic, and match requests with replies. It reads and stores PCAP files, and can inject invalid frames or create custom 802.11 frames. These capabilities suit protocol experiments and specialized network work better than a routine, narrow capture workflow.

Documentation explains how to add protocols and extend Scapy with add-ons, so users can adapt it to protocols beyond its existing support. The online documentation includes installation instructions, usage guides, troubleshooting and an API reference. Optional integrations include Matplotlib, PyX, Graphviz, ImageMagick, VPython-Jupyter and cryptography; plotting needs Matplotlib, while TLS decryption and PKI operations need cryptography.

The latest release is 2.7.1, dated October 1, 2026. Installation is available through pip install scapy, or Scapy can run from the run_scapy and run_scapy.bat scripts without installation.

Pricing

Scapy is free: its plan costs nothing and is licensed under GPL v2. There is no paid tier or trial to weigh against the free edition. This is a strong fit for users who can work within the license; the GPL v2 terms may rule it out for projects that require a different licensing arrangement. Documentation is separately licensed under CC BY-NC-SA 2.5.

Platforms

Scapy runs on Linux, macOS, BSD and Windows. Windows installation requires Npcap, an additional dependency to account for when setting it up. It is available as a Python API, CLI and web deployment, with self-hosted deployment also supported. Capture sources and remote capture are supported, as are traffic decryption, PCAP support, CLI tools and flow analysis.

Optional dependencies shape some workflows: Matplotlib is required for plotting, and cryptography for TLS decryption and PKI operations. Users planning those tasks should include the relevant package in their setup rather than assume every capability works in a minimal installation.

Who it's for

Scapy is aimed at users who need customizable network probing and packet manipulation, including developers, IT professionals, researchers, system administrators and telecommunications practitioners. Python’s syntax doubles as a domain-specific language for describing packets, which suits people who want to combine packet work with Python’s interpreter capabilities. It is a poor fit for someone seeking a fixed-purpose utility with little need to understand protocols or interpret raw packet output.

Pros and cons

Pros: Flexible field values and protocol layering support custom packets without preset templates.

Pros: Shell and library interfaces, PCAP handling, and broad probing tasks let users work in different ways without changing tools.

Pros: Protocol extension guidance and add-ons provide a route to specialized use.

Cons: Python and packet-level output demand technical judgment; Scapy does not make interpretation automatic.

Cons: Windows requires Npcap, while plotting and some security-related operations depend on optional packages.

Cons: The project supports only the latest Scapy master version, so users needing support for older versions should look elsewhere.

Cons: The project has no SECURITY.md file; critical bugs should be reported privately through GitHub’s security tab.

Alternatives

Choose NETCAP if an open-source CLI and 66+ audit record types are a closer match; its Core plan is free forever, while Pro costs $548 a month (billed). Choose termshark for a free, MIT-licensed option on Android, Linux, macOS or Windows, provided you have tshark 1.10.2 or higher.

NetworkMiner is another option, with a free GPLv2 edition whose source is written in managed C# on the Microsoft.NET Framework. Colasoft Capsa offers a Windows free edition limited to monitoring 10 IP addresses, four-hour sessions and no WiFi connection monitoring; its Professional plan costs $695 as a one-time purchase (billed).

Zui is a free option for Linux, macOS and Windows. Arkime is free and open source, with no paid-only features or license fees, for API, Linux, self-hosted and web use. Kismet is free and open source for API, Linux, macOS, self-hosted and Windows. tcpdump is a free BSD-licensed option for Linux, macOS and Windows; capture permission depends on the operating system and configuration.

For a broader comparison, browse Network Protocol Analyzers or Network Packet Analyzer Software.

Verdict

Choose Scapy when your work calls for custom packet construction, probing and capture, and you want Python to define the workflow. Its breadth and extensibility are the reason to pick it; Python demands, optional dependencies and support limited to the latest master version are the reasons to look elsewhere if you need a guided or older-version-supported tool.