= Installing Scapy on Windows =

[http://www.secdev.org/projects/scapy/ Scapy] is primarily being developed for

Unix-like systems and works best on those platforms. But a special port
([http://hg.secdev.org/scapy-win scapy-win]) exists that allows you to use most of
the features on your Windows machine:

* sending and receiving packets

* sniffing
* reading and writing tcpdump capture files
* and even several more advanced features (graphics, plotting)

There are some glitches and known bugs though. Not everything works as nicely as
on Linux yet.

== Download ==

You need the following software packages in order to install Scapy on Windows.

* [http://hg.secdev.org/scapy-win Scapy-win]: [http://hg.secdev.org/scapy-

win/raw-file/tip/scapy.py latest version from the Mercurial repository]. Right
click and save to file.
* [http://www.python.org Python]:
[http://www.python.org/ftp/python/2.5.1/python-2.5.1.msi python-2.5.1.msi]. I'm
using Python 2.5. Scapy-win will work with Python 2.4 as well, but you will need
all third-party extensions on this page compiled for v2.4.
* [http://python.net/crew/mhammond/win32/Downloads.html pywin32]:
[http://surfnet.dl.sourceforge.net/sourceforge/pywin32/pywin32-210.win32-py2.5.exe
pywin32-210.win32-py2.5.exe]
* [http://www.winpcap.org/ WinPcap]:
[http://www.winpcap.org/install/bin/WinPcap_4_0_1.exe WinPcap_4_0_1.exe]. Or if
you want to use the ethernet vendor database to resolve MAC addresses, download
[http://www.wireshark.org/ Wireshark] which already includes !WinPcap.
* [http://code.google.com/p/pypcap/ pypcap]:
[http://www.secdev.org/projects/scapy/files/pcap-1.1-scapy.win32-py2.5.exe pcap-
1.1-scapy.win32-py2.5.exe]. This is a ''special version for Scapy'', as the
original leads to some timing problems. For background info look
[wiki:PypcapScapyWin here].
* [http://code.google.com/p/libdnet/ libdnet]:
[http://libdnet.googlecode.com/files/dnet-1.12.win32-py2.5.exe dnet-1.12.win32-
py2.5.exe]
* [http://ipython.scipy.org/moin/PyReadline/Intro pyreadline]:
[http://ipython.scipy.org/dist/pyreadline-1.3.win32.exe pyreadline-1.3.win32.exe]

Just download the files and run the setup program. Choosing the default
installation options should be safe.

For your convenience I have given direct links to the versions I used (for Python
2.5). If these links do not work or if you are using a different Python version,
just visit the homepage of the respective package and look for a Windows binary.
As a last resort, search the web for the filename. Or use the (somewhat older)
Scapy version that Andrew Evans has compiled: His
[http://www.techshinobi.de/software/scapyandpack.zip zip file] includes the basic
packages that you will need to run Scapy on Python 2.4.

After all packages are installed, open a command prompt (cmd.exe), change to the
directory containing scapy.py and run Scapy with "python scapy.py" (or just
"scapy.py"). For usage information see the
[http://www.secdev.org/projects/scapy/demo.html interactive demo] and the other
documents on [http://www.secdev.org/projects/scapy/ Scapy's homepage].

If really nothing seems to work, consider skipping the Windows version and using
Scapy from a Linux Live CD -- either in a virtual machine on your Windows host or
by booting from CDROM: Scapy is already included in [http://grml.org/ grml] and
[http://www.remote-exploit.org/backtrack.html BackTrack] for example. While using
the Live CD you can easily upgrade to the lastest Scapy version (for Unix) by
typing "cd /tmp && wget scapy.net".

== Optional packages ==

For some special features you have to install more software.

=== Plotting (plot) ===

* [http://www.gnuplot.info/ GnuPlot]:
[http://downloads.sourceforge.net/gnuplot/gp420win32.zip gp420win32.zip]. Extract
the zip file (e.g. to c:\gnuplot) and add the gnuplot\bin directory to your PATH.
* [http://numpy.scipy.org/ Numeric]: [http://biopython.org/DIST/Numeric-
24.2.win32-py2.5.exe Numeric-24.2.win32-py2.5.exe]. Gnuplot-py needs Numeric.
* [http://gnuplot-py.sourceforge.net/ Gnuplot-py]:
[http://mesh.dl.sourceforge.net/sourceforge/gnuplot-py/gnuplot-py-1.7.zip gnuplot-
py-1.7.zip]. Extract to temp dir, open command prompt, change to tempdir and type
"python setup.py install".

Example:

{{{
>>> p=sniff(count=50)
>>> p.plot(lambda x:len(x))
}}}

=== 2D Graphics (psdump, pdfdump) ===

* [http://pyx.sourceforge.net/ Pyx]:
[http://mesh.dl.sourceforge.net/sourceforge/pyx/PyX-0.9.tar.gz PyX-0.9.tar.gz].
Extract to temp dir, open command prompt, change to tempdir and type "python
setup.py install"
* [http://miktex.org/ MikTex]: [http://prdownloads.sourceforge.net/miktex/basic-
miktex-2.6.2742.exe?download basic-miktex-2.6.2742.exe] (52MB). Pyx needs a LaTeX
installation. Choose an installation directory WITHOUT spaces (e.g. C:\!MikTex2.6)
and add (INSTALLDIR)\miktex\bin subdirectory to your PATH.

Example:

{{{
>>> p=IP()/ICMP()
>>> p.pdfdump("test.pdf")
}}}

=== Graphs (conversations) ===

* [http://www.graphviz.org/ Graphviz]:
[http://www.graphviz.org/pub/graphviz/ARCHIVE/graphviz-2.12.exe graphviz-
2.12.exe]. Add (INSTALLDIR)\ATT\Graphviz\bin to your PATH.

Example:
{{{
>>> p=readpcap("myfile.pcap")
>>> p.conversations(type="jpg", target="> test.jpg")
}}}

=== 3D Graphics (trace3d) ===

* [http://www.vpython.org/ VPython]: [http://www.vpython.org/download/VPython-

Win-Py2.5-3.2.11.exe VPython-Win-Py2.5-3.2.11.exe]

Example:

{{{
>>> a,u=traceroute(["www.python.org", "google.com","slashdot.org"])
>>> a.trace3D()
}}}

=== WEP decryption ===

* [http://www.amk.ca/python/code/crypto Pycrypto]:
[http://www.voidspace.org.uk/cgi-bin/voidspace/downman.py?file=pycrypto-
2.0.1.win32-py2.5.zip pycrypto-2.0.1.win32-py2.5.zip]

Example: (using this [http://weplab.sourceforge.net/caps/weplab-64bit-AA-

managed.pcap Weplap test file])

{{{
>>> enc=rdpcap("weplab-64bit-AA-managed.pcap")
>>> enc.show()
>>> enc[0]
>>> conf.wepkey="AA\x00\x00\x00"
>>> dec=Dot11PacketList(enc).toEthernet()
>>> dec.show()
>>> dec[0]
}}}

=== Fingerprinting ===

* [http://insecure.org/nmap/ Nmap].
[http://download.insecure.org/nmap/dist/nmap-4.20-setup.exe nmap-4.20-setup.exe].
If you use the default installation directory, Scapy-win should automatically find
the fingerprints file.
* Queso: [http://www.packetstormsecurity.org/UNIX/scanners/queso-980922.tar.gz
queso-980922.tar.gz]. Extract the tar.gz file (e.g. using [http://www.7-zip.org/
7-Zip]) and put queso.conf into your Scapy directory

{{{
>>> nmap_fp("192.168.0.1")
Begin emission:
Finished to send 8 packets.

Received 19 packets, got 4 answers, remaining 4 packets

(0.88749999999999996, ['Draytek Vigor 2000 ISDN router'])
}}}

== Known bugs ==
 * Packets cannot be sent to localhost (or local IP addresses on your own host).
* The voip_play() functions do not work because they output the sound via
/dev/dsp which is not available on Windows.
* No color prompt in Scapy's interactive console, because ANSI color codes are
not supported on Windows NT based systems.

== Credits ==

Many thanks to Zack Payton, Andrew Evans and all other

[http://hg.secdev.org/scapy-win scapy-win] hackers for making the Windows port of
Scapy possible.

First version of this guide by Dirk Loss, 2007-07-29