Viewing packets with Wireshark
Problem
You have generated or sniffed some packets with Scapy and want to view them with Wireshark, because of its advanced packet dissection abilities.
Solution
That's what the wireshark() function is for:
>>> packets = Ether()/IP(dst=Net("google.com/30"))/ICMP() # first generate some packets >>> wireshark(packets) # show them with Wireshark
Wireshark will start in the background and show your packets.
Discussion
The wireshark() function generates a temporary pcap-file containing your packets, starts Wireshark in the background and makes it read the file on startup.
Please remember that Wireshark works with Layer 2 packets (usually called "frames"). So we had to add an Ether() header to our ICMP packets. Passing just IP packets (layer 3) to Wireshark will give strange results.
You can tell Scapy where to find the Wireshark executable by changing the conf.prog.wireshark configuration setting.
See also
Credits
First version of this recipe by Dirk Loss (2008-03-05).
