test_scapy_ttl.py

from scapy.all import *

paks = rdpcap('sample.pcap')

db = {}


def check_ttl(packet):
    new_ttl = packet.ttl
    src = packet.src

    last_ttl = db.get(src)
    if last_ttl is None:
        db[packet.src] = new_ttl

    else:
        if last_ttl != new_ttl:
            return '{} is banned'.format(src)
        else:
            return '{} passes'.format(src)

for pak in paks:
    print(check_ttl(pak))