Overview

Scapy is a Python program and library for building, sending, capturing, and decoding network packets. It suits developers, administrators, researchers, and other users who want to shape probes themselves rather than rely on fixed-purpose tools. Its flexibility is the draw; working in Python and GPL v2 licensing make it a less natural fit for users seeking a turnkey interface or proprietary software.

Key features

Scapy works both as an interactive shell and as a Python library. Its Python-based packet description lets users set arbitrary field values and stack protocol layers without choosing from predetermined templates. That control is useful for custom probes and unusual packet handling, but it assumes comfort with Python rather than offering a narrow, guided workflow.

It can forge or decode packets, send and capture traffic, and match requests with replies. After a probe, it returns complete decoded packets before interpretation, leaving users free to analyze results their own way. Scapy also supports scanning, tracerouting, probing, network discovery, unit tests, and attacks. The breadth makes it adaptable for varied network work, though it places more responsibility on the user to decide how to interpret raw results.

Packet work extends to reading and storing PCAP files, injecting invalid frames, and creating custom 802.11 frames. Protocol documentation explains how to add new protocols and extend Scapy with add-ons, a practical advantage when standard packet definitions do not cover a task. Optional integrations include Matplotlib, PyX, Graphviz, ImageMagick, VPython-Jupyter, and cryptography; plotting requires Matplotlib, while TLS decryption and PKI operations require cryptography.

Online documentation includes installation guidance, usage guides, troubleshooting, and an API reference. The latest release can be installed with pip install scapy, or run through the run_scapy and run_scapy.bat scripts without installation. Windows installation requires Npcap.

Pricing

Scapy is free: its plan costs 0.00 USD per free and is licensed under GPLv2, with Python 3.7+ required. There is no paid tier or free trial. The free plan provides the packet-manipulation program and library without a stated seat count or usage quota; users should weigh GPL v2 for the code, tests, and tools, and CC BY-NC-SA 2.5 for the documentation, against their licensing needs.

Platforms

Scapy runs on Linux, macOS, BSD, and Windows, with Npcap required for Windows installation. The directory lists API, Linux, macOS, self-hosted, web, and Windows. Its capture and deployment options are marked both, and it supports remote capture, PCAP, CLI tools, traffic decryption, and flow analysis. The breadth suits varied environments, but the Windows Npcap dependency is an added setup requirement.

Who it's for

Scapy is best for users who need customizable packet manipulation and network probing: developers, IT and science or research teams, system administrators, and telecommunications professionals. It is a strong choice when arbitrary packet construction or analysis before interpretation matters. Users who prefer a fixed-purpose utility over a Python-driven workflow should consider a more focused analyzer.

Pros and cons

Pros: Arbitrary field values and protocol-layer stacking give users control over packet construction beyond predetermined templates.
Pros: Full decoded probe results, PCAP handling, and packet capture support flexible analysis and testing workflows.
Pros: Free GPL v2 software with protocol-extension guidance and an API reference can serve both scripting and interactive work.
Cons: Python is central to Scapy’s packet-description approach, which may not suit users looking for a guided, fixed-purpose interface.
Cons: Some tasks depend on optional packages; Windows installation also requires Npcap.
Cons: GPL v2 applies to code, tests, and tools, while documentation has a separate CC BY-NC-SA 2.5 license, so licensing fit needs consideration.

Alternatives

For another free packet-focused choice, NETCAP offers a free forever open-source CLI with 66+ audit record types and community support; its Pro plan costs 548.00 USD per month (billed). NetworkMiner is a free-edition option with source code written in managed C# on the Microsoft .NET Framework and released as GPLv2 software. Kismet is a free and open-source alternative with no paid plan or usage limit stated.

tcpdump is a free BSD-licensed option; capture permission depends on operating system and configuration. TShark is a free alternative from the Wireshark project, maintained by a nonprofit supported by donations. Wireshark offers its full version without a license fee. Arkime is open source, with no paid-only features or license fees. OpenGrep is an open-source static analysis engine delivered as a CLI.

Browse more tools in Network Protocol Analyzers and Network Packet Analyzer Software.

Verdict

Choose Scapy if you need free, highly customizable packet construction and probing in a Python workflow. Its raw decoded results and protocol extensibility are compelling for users who want to control how packets are built and analyzed. Look elsewhere if you need a fixed-purpose tool, want to avoid Python, or cannot work with its GPL v2 licensing and optional package requirements.

	Scapy	tcpdump
Free plan	Yes	Yes
Free trial	No	No
Paid from	Free	Free
Open source	No	No
Platforms	api, Linux, macOS, self-hosted, Web, Windows	Linux, macOS, Windows
Free plan	Yes	Yes
Traffic decryption	Yes	Yes

Scapy vs tcpdump

Scapy

tcpdump