Project 14: Packet Sniffing with Scapy

Module: Module 2: OSINT, Social-Engineering Awareness & Traffic Analysis  |  Level: Beginner  | 
Primary tool: Scapy (Python)  |  Estimated time: 45–75 minutes

Objective: Build and parse raw packets programmatically to understand protocols at the byte level.

Free lab environment

scanme.nmap.org + TryHackMe (free tier) — https://scanme.nmap.org/ and https://tryhackme.com/room/introtonetworking

scanme.nmap.org is the Nmap Project’s own public host, explicitly maintained for learners to scan legally, so long as you scan lightly and do not run intrusive options like heavy vulnerability scripts or denial-of-service tests against it. For anything more thorough, create a free TryHackMe account and deploy the room’s disposable target machine instead.

Lab workflow

1. Write a one-paragraph scope note: your target is your own loopback/local VM traffic, your tool is Scapy (Python), and your goal is to build and parse raw packets programmatically to understand protocols at the byte level.
2. Confirm authorization: re-read the lab platform’s terms and this project’s Safety section before sending a single packet.
3. Run your baseline Scapy (Python) command against the target and save the raw output to a text file before you interpret anything.
4. Interpret the output: for every result, write one sentence on what it tells a defender, not just what it tells an attacker.
5. Re-run the same command a second time and compare results — note anything that changed, since real infrastructure is not static.
6. Package your findings into the report format described under Expected Deliverable below.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• your Scapy script
• its console output showing a crafted packet you built and then captured with Wireshark

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.