I'm trying to use a Raspberry Pi to find ARP requests from a specific wireless device on my network. It's one of those Amazon dash buttons. Someone used this code to listen to when the dash connects to wifi.

from scapy.all import *
def arp_display(pkt):
  if pkt[ARP].op == 1: #who-has (request)
    if pkt[ARP].psrc == '': # ARP Probe
      if pkt[ARP].hwsrc == '74:75:48:5f:99:30': # button 1
        print "Pushed Huggies"
      elif pkt[ARP].hwsrc == '10:ae:60:00:4d:f3': # button 2
        print "Pushed Elements"
        print "ARP Probe from unknown device: " + pkt[ARP].hwsrc

print sniff(prn=arp_display, filter="arp", store=0, count=10)

When I run this on Raspbian (with python and scapy installed), I get an error

"IndexError: Layer [ARP] not found"

I'm totally unfamiliar with scapy and just diving in for the first time. Thanks for any ideas.

  • Did you ever get this working? I've gotten past that issue but still can't see an ARP request from my button
    – jbnunn
    May 29, 2016 at 22:37
  • @jbnunn this answer worked for me stackoverflow.com/questions/24415294/…
    – Katu
    Nov 18, 2017 at 17:38

4 Answers 4


I too am doing the same thing. What I found was that tcpdump was not installed.

A simple sudo apt-get install tcpdump fixed this error for me.


I had the same error, but found it doesn't happen reliably, sometimes it fails immediately with:

IndexError: Layer [ARP] not found

and sometimes it runs forever.

Hint: Set count=0 in the print sniff line to have it run forever, count appears to be timeout.

I had initially installed scapy from the website, but ended up doing:

apt-get update
apt-get upgrade
apt-get install tcpdump tcpreplay wireshark python-scapy

and it seems to run just fine when it runs. Not sure I needed all of the above, but python-scapy recommended them (and a bunch of graphics routines) when I installed it.

Addenda: Each time I fiddle with the code the probability that it'll run without crashing changes, so there's something really weird going on.


We had the same issue here, and it turns out we forgot to check one condition.

Just add this line before all the if blocks:

if pkt.haslayer(ARP):

on my Raspy B 2012 it eats up >50% of the CPU.

What I tried was

sniff(filter="tcp and port 123", prn=print_summary,store=0)

I redirected the Dash-button requests to the IP of the machine where Scapy runs via my Firewall. The idea was to save ressources and not to monitor all the traffic for mac adresses but only to watch connection requests on to port.

This consumes ~30% Cpu. It works on a Ubuntu machine, but on a Raspi B it takes around 5 minutes to start to work and then shows Connections from all over my network - what it does not on the Ubuntu machine. I assume its broken on Raspy Musicbox image.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .