Scapy is a Python library that builds, sends, captures and decodes network packets one layer and one field at a time. Security researcher Philippe Biondi wrote it in 2003, and the SecDev team now maintains it together with a community of contributors on the secdev/scapy GitHub repository. The code is released under the GPL v2 free software licence. According to the project page on PyPI, version 2.8.0 was published on 2 October 2026 and needs at least Python 3.7.
What Scapy is for
The best way to understand Scapy is to compare it with a conventional network tool, which does one job decided in advance. Ping sends an ICMP request, Nmap looks for open ports. Scapy makes no such decision for you. It exposes Python classes that stand for protocols, from Ethernet, IP, TCP, UDP, DNS and ARP to several hundred others, and a packet is assembled by stacking those layers with the division operator. Every field carries a sensible default value that can be overridden, so a single line of code produces either a perfectly valid packet or a deliberately broken one.
The documentation sums up the design in one sentence: Scapy decodes, it does not interpret. When an answer comes back, the library hands over the whole decoded packet and leaves the conclusions to the user rather than printing a verdict such as a filtered port. This is why the authors describe it as a replacement for hping, arping or arpspoof, and for a good part of Nmap and tcpdump. It also reads and writes pcap files, which makes it a natural companion to Wireshark.
Two neighbours in the same section of our software library serve different needs. Ostinato is a graphical traffic generator meant to push high volumes of packets from templates. Masscan is a specialised port scanner written in C whose only purpose is to sweep enormous address ranges as fast as possible. Scapy sits elsewhere: it trades raw speed for flexibility and precision, and it suits someone who wants to inspect one specific exchange or write a tailored test.
Engineers rely on it to confirm that a firewall really enforces its rules, to reproduce a bug in a network stack, to write a small fuzzer that sends variations of the same packet, or to teach how TCP works by watching every segment. Version 2.8.0 broadened its reach with automotive protocols such as SAE J1939 and UDS, Bluetooth modules, DICOM, PTP and the classic MySQL protocol, as the release notes published on GitHub explain.
Who is it for?
Scapy is aimed first at offensive and defensive security professionals, at network administrators chasing an odd behaviour, at protocol developers and at teachers. The one real prerequisite is comfort with Python, since the language serves both as the user interface and as the scripting language.
Its limits are just as clear. Being written in Python, Scapy is not designed to saturate a link or to scan millions of hosts; Ostinato or Masscan will do those jobs far better. Sending and capturing raw packets requires administrator privileges on every platform. Finally, it is not a graphical analyser: to browse a large capture comfortably, Wireshark remains the right choice.
Download Scapy safely
The official release lives on the Python package index PyPI, and the command pip install scapy is all that is needed on Linux and macOS. The scapy.net site points to the secdev/scapy repository on GitHub, where the source code and the archive of every version are available. Debian and Ubuntu also ship the python3-scapy package, and OpenBSD the python-scapy package, according to the installation guide. On Windows the Npcap capture driver must be installed first, then Scapy through pip; the documentation notes that WinPcap still works but is no longer supported.
Scapy is completely free and has no paid or professional edition. Because it is a Python package, the main risk is a look-alike package uploaded to PyPI by a stranger: make sure the project you install lists Philippe Biondi as author and scapy.net as its home page. A Windows executable installer offered by a third-party download site has no reason to exist and should be left alone.
Frequently asked questions
Is Scapy free?
Yes. Scapy is free software distributed under the GPL v2 licence, with no paid tier and no locked features. The documentation is published under the Creative Commons BY-NC-SA 2.5 licence, which has no effect on how the software itself may be used.
Do I need administrator rights to use Scapy?
To send raw packets or listen on an interface, yes, on Linux, macOS and Windows alike, because the operating system reserves those operations for privileged accounts. Reading an existing pcap file or building packets without sending them works from an ordinary account.
Does Scapy run on Windows?
Yes, provided the Npcap driver is installed beforehand, as it is required to reach the network card. The documentation recommends turning off the WinPcap compatibility mode during the Npcap installation, then installing Scapy with pip and launching it from the command prompt.
