Which statement best describes building packets in Scapy?

• A. Packets must be created as a single call to a protocol layer
• B. Packets can only be created in memory, not displayed
• C. Packets cannot be built with Layer 2 headers
• D. Packets can be built by composing protocol layers and can include Layer 2 like Ether()

Answer: (D)

Packets in Scapy are built by composing protocol layers rather than creating a single block. Each layer represents a protocol with its own fields, and you stack these layers to form the complete packet. This is typically done using the / operator, for example Ether()/IP()/TCP(), which builds an Ethernet frame carrying an IP packet with a TCP segment. The approach lets you start with a Layer 2 header like Ether() when you want to craft a full Ethernet frame, or omit it to create a Layer 3 packet. This layering flexibility—combining protocol layers and optionally including a Layer 2 header—is why that description is the best fit. Packets are created in memory and can be inspected, modified, and sent at either Layer 2 or Layer 3 as needed.