Scapy vs Wireshark

Scapy is a free Python packet manipulation program and library for forging or decoding packets, sending and capturing them, and matching requests with replies. It can run as an interactive shell or be used as a library. Listed tasks include scanning, tracerouting, probing, unit tests, attacks and network discovery. Users can set arbitrary field values and stack protocol layers rather than rely on predetermined templates; after a probe, Scapy returns full decoded packets before interpretation for further analysis. It can read and store pcap files, inject invalid frames and custom 802.11 frames, and be extended with protocols and add-ons. Scapy runs on Linux, macOS, BSD and Windows, though Windows installation requires Npcap. Optional plotting needs Matplotlib; TLS decryption and PKI operations need the cryptography package. The code, tests and tools use GPL v2, while the documentation uses CC BY-NC-SA 2.5. Documentation includes installation instructions, usage guides, troubleshooting and an API reference. The project supports only its latest master version, and critical bugs should be reported privately through GitHub’s security tab.

Wireshark is a free network protocol analyzer for capturing and examining network traffic. It supports live capture and offline analysis through a graphical interface or the TShark terminal utility, and can inspect hundreds of protocols. Display filters narrow what appears during analysis, though their syntax differs from capture filters. Wireshark reads and writes capture formats including pcap and pcapng, and can decompress gzip-compressed files. Analysis features include VoIP tools, packet coloring rules, and exports to XML, PostScript, CSV, or plain text. It can decrypt traffic for protocols including IPsec, Kerberos, SSL/TLS, WEP, and WPA/WPA2. The software is available for Linux, macOS, and Windows under GNU General Public License version 2, with no license fee for the full version. Windows packages include Npcap, which is needed for live packet capture. What a capture can show depends on the operating system, capture library, network interface, and network configuration; switched networks may not expose unicast traffic between other ports. Community help is available through a Q&A site and users mailing list.