analyzing-network-packets-with-scapy

name	analyzing-network-packets-with-scapy
description	Craft, send, sniff, and dissect network packets using Scapy for protocol analysis, network reconnaissance, and traffic anomaly detection in authorized security testing. Use when working with analyzing network packets with scapy.
domain	cybersecurity
subdomain	network-security
tags	["scapy","packet-analysis","network-forensics","protocol-dissection","pcap","traffic-analysis"]
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]

Analyzing Network Packets with Scapy

Overview

Scapy is a Python packet manipulation library that enables crafting, sending, sniffing, and dissecting network packets at granular protocol layers. This skill covers using Scapy for security-relevant tasks including TCP/UDP/ICMP packet crafting, pcap file analysis, protocol field extraction, SYN scan implementation, DNS query analysis, and detecting anomalous traffic patterns such as unusually fragmented packets or malformed headers.

When to Use

Trigger phrases:

• "analyzing network packets with scapy"

• "Craft, send, sniff, and dissect network packets using Scapy for protocol analysi"

• When investigating security incidents that require analyzing network packets with scapy

• When building detection rules or threat hunting queries for this domain

• When SOC analysts need structured procedures for this analysis type

• When validating security monitoring coverage for related attack techniques

Prerequisites

• Python 3.8+ with scapy library installed (pip install scapy)
• Root/administrator privileges for raw socket operations (sniffing, sending)
• Npcap (Windows) or libpcap (Linux) for packet capture
• Authorization to perform packet operations on target network

Steps

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Read and parse pcap/pcapng files with rdpcap() for offline analysis