Which Scapy function reads packets from a capture file?

• A. Reads packets from a pcap file
• B. Captures live traffic
• C. Writes packets to a pcap file
• D. Sends packets to multiple destinations

Answer: (A)

rdpcap is the function used to read packets from a capture file. It opens a pcap (or pcapng) file and returns the captured packets as a list of Scapy Packet objects, which you can then inspect, dissect, or analyze offline. This is specifically for offline processing of pre-recorded traffic, as opposed to live capture. If you’re dealing with very large files and want to process packets one at a time without loading everything into memory, you can use PcapReader to iterate through packets lazily. The other actions described relate to capturing live traffic, writing packets to a capture file, or sending packets to destinations, not reading from a file.