scapy_example.py

from scapy.all import *
from scapy.layers.dns import DNSRR, DNS, DNSQR


packet = IP()/TCP()
Ether()/packet
ls(IP, verbose=True)

p = Ether()/IP(dst="www.google.com")/TCP()
print(p.summary())

print(p.dst)  # first layer that has an src field, here Ether
print(p[IP].src)  # explicitly access the src field of the IP layer
print(p[IP].dst)  # explicitly access the src field of the IP layer

# sprintf() is a useful method to display fields
print(p.sprintf("%Ether.src% > %Ether.dst%\n%IP.src% > %IP.dst%"))

print(p.sprintf("%TCP.flags% %TCP.dport%"))

[p for p in IP(ttl=(1,5))/ICMP()]

p=sr1(IP(dst="8.8.8.8")/UDP()/DNS(qd=DNSQR()))
p[DNS].an
if p.haslayer(DNS):
    if p.qdcount > 0 and isinstance(p.qd, DNSQR):
        name = p.qd.qname
    elif p.ancount > 0 and isinstance(p.an, DNSRR):
        name = p.an.rdata
    print(name);