Overview

Scapy combines an interactive shell with a library, so users can explore packets interactively or incorporate packet operations into Python code. Its flexible approach is a strong fit for custom probing and network experiments, but expects users to decide what to build and how to interpret the results.

The project identifies scanning, tracerouting, probing, unit tests, attacks and network discovery as use cases. GPL v2 applies to its code, tests and tools; its documentation uses CC BY-NC-SA 2.5. Teams choosing it for commercial or internal work should account for those terms.

Key features

Users can forge and decode packets, send and capture traffic, and match requests with replies. Scapy lets them set arbitrary field values and stack protocol layers without predetermined templates. That makes it useful when a standard probe cannot express the packet a task requires, while placing the design and analysis burden on the user.

Probe results are returned as fully decoded packets before interpretation. Analysts can apply their own analysis rather than rely on a fixed presentation of findings; users who want conclusions delivered through a narrow, guided workflow may prefer another tool.

Scapy reads and stores PCAP files, and can inject invalid frames or custom 802.11 frames. Documentation explains how to add protocols and extend Scapy with add-ons, which helps teams adapt it to specialized packet work. Plotting requires Matplotlib; TLS decryption and PKI operations require the cryptography package. Optional integrations also include PyX, Graphviz, ImageMagick and VPython-Jupyter, so some workflows bring extra dependency management.

Pricing

Scapy is free: the Scapy plan costs 0.00 USD per free and is licensed under GPLv2. It includes the packet toolkit without a paid tier or free trial. Python 3.7+ is required. The free plan is a practical fit for individuals and teams prepared to work within the license; it does not offer a proprietary licensing route.

Platforms

Scapy runs on Linux, macOS, BSD and Windows, and supports API, web and self-hosted environments. Windows installation requires Npcap. The latest release can be installed with pip install scapy, or run through the run_scapy and run_scapy.bat scripts without installation.

Online documentation includes installation guidance, usage guides, troubleshooting and an API reference. The project supports only the latest Scapy master version. Critical bugs should be reported privately through GitHub's security tab; the project has not set up a SECURITY.md file.

Who it's for

Scapy is aimed at developers, IT staff, scientists and researchers, system administrators, and telecommunications teams who need customizable network probing or packet manipulation. Its Python interface and extensible protocol handling reward users who are comfortable working directly with packets. It is less suited to teams seeking a fixed-purpose utility that makes packet-level choices for them.

Pros and cons

Pros: Shell and library workflows let users explore interactively or integrate packet work into Python.
Pros: Arbitrary fields, layered protocols and raw decoded probe results support custom analysis instead of template-bound probes.
Pros: PCAP handling, custom 802.11 frames and protocol extensions cover specialized network tasks.
Cons: Windows use requires Npcap, adding a platform-specific dependency.
Cons: Plotting, TLS decryption and PKI operations depend on optional packages, increasing setup work for those features.
Cons: GPL v2 licensing and support limited to the latest master version may not suit teams requiring proprietary terms or broader version support.

Alternatives

For another free, open-source packet-analysis option, Arkime has no paid-only features or license fees and supports Linux, self-hosted and web environments.

Kismet is also free and open source, with Linux, macOS, self-hosted and Windows support. Consider it as another no-cost option when those platforms fit your deployment.

If you need a paid service with a trial, VoIPmonitor offers a Cloud 3 channels plan for 22.00 USD per month, with full features, 21 days of CDR retention and PCAP kept on your server.

NetworkMiner is a freemium alternative for Linux, macOS and Windows; its source code is GPLv2 free and open source software written in managed C# on the Microsoft .NET Framework.

NETCAP offers a free, open-source CLI Core plan with 66+ audit record types and community support, plus a paid Pro plan. Consider it when audit records and a CLI are a better fit than Scapy's Python packet construction.

tcpdump is a free option for Linux, macOS and Windows; capture permission depends on operating system and configuration.

TShark is a free, GPL v2 network analysis option for Linux, macOS and Windows, maintained by the Wireshark project.

Wireshark is another free option for Linux, macOS and Windows, with no license fee.

Browse Network Protocol Analyzers and Network Packet Analyzer Software for more options.

Verdict

Scapy is the right choice for Python-capable builders who need precise control over packet construction, probing and analysis, with no software charge. Its flexibility and extensibility are compelling; choose another tool if your team needs a guided analyzer, cannot use GPL v2 software, or wants to avoid optional dependencies and Windows Npcap setup.

	Arkime	Scapy
Free plan	Yes	Yes
Free trial	No	No
Paid from	Free	Free
Open source	No	No
Platforms	api, Linux, self-hosted, Web	api, Linux, macOS, self-hosted, Web, Windows
Free plan	Yes	Yes
Traffic decryption	No	Yes

Arkime vs Scapy

Arkime

Scapy