Packet crafting and pcap analysis with Scapy
You build packets layer by layer with Scapy, inspect recorded traffic in Python and find suspicious patterns with your own code.
Level 301 · 17 lessons · 15 practice labs
Lessons
Meeting Scapy
- Layers and fields: Ether, IP, TCP
- sr, sr1 and matching replies
- ARP and ICMP discovery with Scapy
- Writing your own traceroute with Scapy
- Short task: map the MAC and IP of the devices in the lab network
Reading recorded traffic
- Large files with rdpcap and PcapReader
- Grouping packets into flows and conversations
- Extracting DNS queries and answers from a pcap
- Finding cleartext HTTP requests and credentials
- Short task: find the internal host that sent the most data
Suspicious patterns
- Recognising a port scan in traffic
- Finding a host that calls out at regular intervals
- Signs of DNS exfiltration: long, random names
- Carving files out of traffic and hashing them
- Short task: find the host talking to a command server in a mixed capture
Wrap-up
- Reporting findings as a timeline
- Capstone: a tool that triages a pcap file automatically
Practice labs
- A MAC-to-IP map of the lab network: Write a Scapy script that sends ARP requests across your own lab subnet and tables the MAC and IP of each responding device.
- A hop that goes missing: Write your own traceroute in Scapy by raising the TTL, mark the router that sends no ICMP reply, and show how many hops it takes to reach the target.
- Replies matched to the wrong requests: Rewrite a discovery script that pairs sent and received packets in its own loop and gets them wrong to use sr, and list unanswered targets separately.
- The host that sent the most data: Write a script that totals the bytes sent by internal hosts in the given pcap and finds the top sender and its destinations.
- A pcap that does not fit in memory: Rewrite an analysis script that exhausts memory with rdpcap to stream with PcapReader, and show it produces the same conversation table with far less memory.
- A timeline from conversations: Group the packets in the Silverwater Municipality incident capture into flows by five-tuple, extract start, duration and bytes per flow, and produce the incident timeline.
- DNS queries in a pcap: Write a script that pairs DNS queries and answers in the given capture and lists which host asked for which name and the address it got.
- A first-look summary for a pcap: Write a tool that produces a one-page report of protocol mix, top talkers, DNS names and cleartext protocols for any pcap file.
- A tool that crashes on a damaged pcap: Harden a triage tool that crashes on a truncated pcap with unknown layers, and show it still reports on every readable packet.
- A cleartext HTTP login: Write a script that finds login forms sent over cleartext HTTP in the given pcap and reports which internal app must move to HTTPS.
- Long, random subdomains: Find the host suspected of DNS data exfiltration and the domain it uses by looking at subdomain length and entropy in the capture’s DNS queries.
- Carve a file out of traffic: Reassemble a fragmented HTTP download in the capture by TCP sequence number, carve the file, hash it with SHA-256 and compare it with the given known-bad list.
- A port scan in a capture: Write a script that finds the source sending SYNs to many different ports in a short time, and report the scanned port range.
- A host that calls out at regular intervals: Find the host beaconing at a regular interval in the Brightfield Labs capture by looking at the variation in connection gaps, and show the interval in seconds.
- Command traffic hidden in noise: In a mixed capture full of update and backup traffic, filter out legitimate periodic jobs to find the one host talking to a command server, and write down why.
About this course
You build packets layer by layer with Scapy, inspect recorded traffic in Python and find suspicious patterns with your own code.
What you will learn
- Meeting Scapy
- Reading recorded traffic
- Suspicious patterns
- Wrap-up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.