Scapy installation fails on osx with dnet import error

Question

Having trouble installing Scapy and it's required dependancies. I have spent some time Googling for a solution but all 'solutions' seem to affect older versions of Python, or simply do not work.

Script:

#!/usr/bin/python

import threading
import Queue
import time
from scapy.all import *

class WorkerThread(threading.Thread) :

    def __init__(self, queue, tid) :
        threading.Thread.__init__(self)
        self.queue = queue
        self.tid = tid
        print 'Worker: %d' %self.tid

    def run(self) :
        total_ports = 0
        while True :
            port = 0
            try :
                port = self.queue.get(timeout=1)
            except Queue.Empty :
                print 'Worker %d exiting. %d ports scanned'  %(self.tid, total_ports)

                return

                #Scanning begins

            ip = sys.argv[1]
            response = sr1(IP(dst=ip)/TCP(dport=port, flags='S'), verbose=False, timeout=.2)


            if response :
                if response[TCP].flags == 18 :

                    print 'ThreadID: %d: Got port no. %d status: OPEN' %(self.tid, port)
                self.queue.task_done()
                total_ports += 1

queue = Queue.Queue()

threads = []
for i in range(1, 10) :
    print 'Creating WorkerThread : %d' %i
    worker = WorkerThread(queue, i)
    worker.setDaemon(True)
    worker.start()
    threads.append(worker)
    print 'WorkerThread %d created' %i

for j in range(1, 100) :
    queue.put(j)

queue.join()

for item in threads :
    item.join()

print 'Scanning complete'

Python version is 2.7.5 and path to Python verified.

which python
/usr/bin/python

When script is executed I am getting the following error:

./multi-threaded-scanner.py
Traceback (most recent call last):
  File "./multi-threaded-scanner.py", line 6, in <module>
    from scapy.all import *
  File "/Library/Python/2.7/site-packages/scapy/all.py", line 16, in <module>
    from arch import *
  File "/Library/Python/2.7/site-packages/scapy/arch/__init__.py", line 75, in <module>
    from bsd import *
  File "/Library/Python/2.7/site-packages/scapy/arch/bsd.py", line 12, in <module>
    from unix import *
  File "/Library/Python/2.7/site-packages/scapy/arch/unix.py", line 20, in <module>
    from pcapdnet import *
  File "/Library/Python/2.7/site-packages/scapy/arch/pcapdnet.py", line 160, in <module>
    import dnet
ImportError: No module named dnet

I can use both the Scapy and Python interactive interpreters and running import scapy in the Python interpreter produces no errors. When the script was run initially the pcapy module was missing, however I installed that and then the issue switched to dnet, which I cannot find a solution for. A similar post, seems to describe the same issue but the workarounds have no effect. Can anybody shed any more light on this issue?

Commands used to install pcapy and libdnet:

libdnet-1.11.tar.gz (01-19-2005)

` ~/Downloads/libdnet-1.11    
chmod a+x configure
 ~/Downloads/libdnet-1.11    
./configure  && make`

Exits successfully

Pcapy: Latest stable release (0.10.8), updated August 26, 2010

~/Downloads/pcapy-0.10.8 
sudo python setup.py install Password: running install running build running build_ext running build_scripts running install_lib running install_scripts changing mode of /usr/local/bin/96pings.pcap to 777 changing mode of /usr/local/bin/pcapytests.py to 777 running install_data running install_egg_info Removing /Library/Python/2.7/site-packages/pcapy-0.10.8-py2.7.egg-info Writing /Library/Python/2.7/site-packages/pcapy-0.10.8-py2.7.egg-info ~/Downloads/pcapy-0.10.8 

Results for compiling with new flags

 ~/Downloads/libdnet-1.12    
sudo CFLAGS='-arch i386 -arch x86_64' ./configure --prefix=/usr and archargs='-arch i386 -arch x86_64' make
configure: WARNING: you should use --build, --host, --target
configure: WARNING: you should use --build, --host, --target
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
/Users/richardcurteis/Downloads/libdnet-1.12/config/missing: Unknown `--is-lightweight' option
Try `/Users/richardcurteis/Downloads/libdnet-1.12/config/missing --help' for more information
configure: WARNING: 'missing' script is too old or missing
checking for a thread-safe mkdir -p... config/install-sh -c -d
checking for gawk... no
checking for mawk... no
checking for nawk... no
checking for awk... awk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking whether to enable maintainer-specific portions of Makefiles... no
checking build system type... Invalid configuration `and': machine `and' not recognized
configure: error: /bin/sh config/config.sub and failed
 ~/Downloads/libdnet-1.12   

Answer 1

EDIT (30.10.19)

Install Scapy

Scapy's official documentation lists the possible bundles:

• Default, only Scapy:
  • $ pip install scapy
• Recommended, Scapy and iPython:
  • $ pip install --pre scapy[basic]
• Complete, Scapy & all its main dependencies:
  • $ pip install --pre scapy[complete]

Install optional dependencies

Scapy requires certain dependencies for some special features, such as for plotting, 2D & 3D graphics, WEP decryption, PKI operations and TLS decryption, fingerprinting and VOIP. Most of these software are installable via pip. Scapy's official documentation presents them along with some examples that test whether the installation was successful.

Configure libpcap integration

Scapy's official documentation states that it works natively since the recent versions but it's possible to configure it to use libpcap, which may be installed using either Homebrew or MacPorts. Both installation methods work fine, yet Homebrew is used to run unit tests with Travis CI. Note that Libpcap might already be installed, for example if tcpdump is installed, such as in the case of OSX.

Install using Homebrew

$ brew update  # update Homebrew
$ brew install libpcap  # install libpcap

Enable it in Scapy via from scapy.config import conf; conf.use_pcap = True.

Install using MacPorts

$ sudo port -d selfupdate  # update MacPorts
$ sudo port install libpcap  # install libpcap

Enable it in Scapy via from scapy.config import conf; conf.use_pcap = True.

---

EDIT (27.05.15)

This answer states that all mentioned issues were fixed, and provides a much simpler installation method. However, its comments suggest that although it seems to work on OS X 10.10 Yosemite and OS X 10.11 El Capitan, it might fail for certain other versions.

$ brew install libdnet --with-python
$ pip install pcapy
$ pip install scapy

If Homebrew's site-packages is not in Python's sys.path variable, the following should be executed (see this for more information), with the actual username replacing the placeholder <USERNAME>:

$ mkdir -p /Users/<USERNAME>/Library/Python/2.7/lib/python/site-packages
$ echo 'import site; site.addsitedir("/usr/local/lib/python2.7/site-packages")' >> /Users/<USERNAME>/Library/Python/2.7/lib/python/site-packages/homebrew.pth

---

The original answer

You have not completed the installation of libdnet and its Python wrapper, as stated in Scapy's installation guide:

$ wget https://github.com/dugsong/libdnet/archive/libdnet-1.12.tar.gz
$ tar xfz libdnet-1.12.tgz
$ ./configure
$ make
$ sudo make install
$ cd python
$ python2.5 setup.py install

If your system is 64 bit, use these compilation commands instead:

$ CFLAGS='-arch i386 -arch x86_64' ./configure
$ archargs='-arch i386 -arch x86_64' make

Moreover, please verify that you've installed the correct version, i.e. 1.12 rather than 1.11.

If that fails as well, try installing via MacPorts and use its dnet.so file, as described here:

$ port selfupdate
$ port upgrade outdated
$ port install py27-libdnet
$ port install libdnet 
$ cp /opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/dnet.so /Library/Python/2.7/site-packages

That link also recommends changing some code in /Library/Python/2.7/site-packages/scapy/arch/unix.py (fix OSError: Device not configured).

Change line 34 from:

f=os.popen("netstat -rn") # -f inet

to:

f=os.popen("netstat -rn | grep -v vboxnet") # -f inet

as follows:

def read_routes():
    if scapy.arch.SOLARIS:
#       f=os.popen("netstat -rvn") # -f inet
        f=os.popen("netstat -rn | grep -v vboxnet") # -f inet

If you still get the error OSError: Device not configured, then try performing similar changes to the other branches of the if clause (specifically, to its else branch), as described in this answer.

Answer 2

In OSX El Capitan, what worked for me was to force pip to reinstall pcapy using sudo: sudo pip install --user pcapy -I

Answer 3

(This is a comment to Tim Wu's Answer, but I'm missing the reputation to do so)

Keep in mind to do what brew is actually telling you:

==> Caveats
Python modules have been installed and Homebrew's site-packages is not in your Python sys.path, so you will not be able to import the modules this formula installed.
If you plan to develop with these modules, please run: [...]

mkdir -p /Users/YourUsernameHere/Library/Python/2.7/lib/python/site-packages
echo 'import site; site.addsitedir("/usr/local/lib/python2.7/site-packages")' >> /Users/YourUsernameHere/Library/Python/2.7/lib/python/site-packages/homebrew.pth

So just re-run the brew command and execute the two lines it's telling you there to use all installed brew python packages.

Answer 4

All issues mentioned above seem all fixed. I'm running OS X Yosemite. I got a working scapy by simply the following three commands.

brew install --with-python libdnet
pip install pcapy
pip install scapy

Answer 5

I'm running OSX 10.5.9 - spent forever trying to get scapy working - after installing dnet/pcap libraries I got the "OSError:Device not configured" too. Tried replacing line 34 in unix.py with

"netstat -rn | grep -v vboxnet"

Still got the same error. But when I change line 37 instead in the "else" part of the if block:

def read_routes():
    if scapy.arch.SOLARIS:
        f=os.popen("netstat -rvn") # -f inet
    elif scapy.arch.FREEBSD:
        f=os.popen("netstat -rnW") # -W to handle long interface names
    else:
        # f=os.popen("netstat -rn") # -f inet
        f=os.popen("netstat -rn | grep -v vboxnet") # -f inet

Works like a charm!