Overview

Scapy combines an interactive shell with a Python library, so users can work at the prompt or incorporate packet operations into code. It supports scanning, tracerouting, probing, network discovery, unit tests and attacks. This breadth suits exploratory and specialized network work, but users must shape their own workflows rather than rely on a narrow, guided tool.

Key features

Users can assign arbitrary field values and stack protocol layers without being confined to predetermined packet templates. Scapy can forge and decode packets, send and capture traffic, and match requests with replies. After a probe, it returns fully decoded packets before interpretation, preserving room for custom analysis but leaving the interpretation to the user.

It reads and stores PCAP files, injects invalid frames and supports custom 802.11 frames. Documentation explains how to add protocols and extend Scapy with add-ons, which is useful when standard packet definitions do not cover a task. Online guides include installation, usage, troubleshooting and an API reference.

Scapy can be installed with pip install scapy or run from the provided platform scripts without installation. Optional integrations include Matplotlib, PyX, Graphviz, ImageMagick, VPython-Jupyter and cryptography. Plotting requires Matplotlib; TLS decryption and PKI operations require cryptography, so those tasks bring additional setup.

Pricing

Scapy costs 0.00 USD per free, with no free trial. The free plan includes the GPL v2-licensed code, tests and tools, and requires Python 3.7 or later. There are no paid tiers or usage caps described. The GPL v2 license is a material consideration for anyone evaluating Scapy for use in a proprietary software distribution.

Platforms

Scapy runs on Linux, macOS, BSD and Windows; Windows installation requires Npcap. Its published platform coverage also includes API, self-hosted and web. Capture sources and remote capture are supported. The project supports only the latest Scapy master version, which may not suit teams that need support across older versions. Critical bugs should be reported privately through GitHub's security tab; the project has not set up a SECURITY.md file.

Who it's for

Scapy is a strong fit for developers, IT and system administrators, telecommunications professionals, and science and research users who need to customize network probes or manipulate packets directly. Its Python syntax makes it particularly appropriate for people already comfortable using Python as a working language. Readers looking for a ready-made analyzer with a more prescribed workflow should consider a different tool.

Pros and cons

Pros: Arbitrary field values and protocol layering support packet work beyond fixed templates.
Pros: Shell and library access, plus PCAP handling and request-reply matching, cover varied workflows.
Pros: Protocol extension guidance and add-ons leave room for specialized use.
Cons: Python-based operation and raw decoded results expect users to build workflows and interpret output themselves.
Cons: Windows requires Npcap, while plotting, TLS decryption and PKI operations depend on optional packages.
Cons: Support is limited to the latest master version, and the security page lacks a SECURITY.md file.

Alternatives

For a free CLI focused on audit records, choose NETCAP; its free Core plan includes 66+ audit record types and community support, while Pro costs 548.00 USD per month. NetworkMiner is another free-edition option for Linux, macOS and Windows. Consider Arkime for a free, open-source option with no paid-only features or license fees, or Kismet for free, open-source software with no stated usage limit.

OpenGrep is a free CLI static analysis engine. For free packet capture tools, compare tcpdump, whose BSD license accompanies capture permissions that depend on operating system and configuration, with TShark and Wireshark, both free tools from the Wireshark project ecosystem.

Browse Network Protocol Analyzers and Network Packet Analyzer Software for more options.

Verdict

Choose Scapy if you need packet-level control, custom probes and extensibility in a free Python tool. Its strongest reason to choose it is the ability to construct and analyze packets without fixed templates; look elsewhere if you need a guided workflow or support beyond the latest master version.

	Arkime	Scapy
Free plan	Yes	Yes
Free trial	No	No
Paid from	Free	Free
Open source	No	No
Platforms	api, Linux, self-hosted, Web	api, Linux, macOS, self-hosted, Web, Windows
Free plan	Yes	Yes
Traffic decryption	No	Yes

Arkime vs Scapy

Arkime

Scapy