Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Remove ARP entry limitation #4892

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mdennis281 wants to merge 1 commit into secdev:master
base: master
Choose a base branch
Loading
from mdennis281:master
Open

Conversation

@mdennis281
Copy link

@mdennis281 mdennis281 commented Jan 1, 2026

Fixes #4787
I'm removing the hardcoded ARP cache entry limit on MacOS because it's causing Scapy to raise on import if the ARP cache is larger than 4096.

Import error traceback 
(.env) mikedennis@CVX-Mac LANscape % python
Python 3.11.2 (main, Feb 16 2023, 02:55:59) [Clang 14.0.0 (clang-1400029.202)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> from scapy.sendrecv import srp
Traceback (most recent call last):
 File "<stdin>", line 1, in <module>
 File "/Users/mikedennis/Documents/GitHub/LANscape/.env/lib/python3.11/site-packages/scapy/sendrecv.py", line 60, in <module>
 import scapy.route # noqa: F401
 ^^^^^^^^^^^^^^^^^^
 File "/Users/mikedennis/Documents/GitHub/LANscape/.env/lib/python3.11/site-packages/scapy/route.py", line 250, in <module>
 conf.route = Route()
 ^^^^^^^
 File "/Users/mikedennis/Documents/GitHub/LANscape/.env/lib/python3.11/site-packages/scapy/route.py", line 37, in __init__
 self.resync()
 File "/Users/mikedennis/Documents/GitHub/LANscape/.env/lib/python3.11/site-packages/scapy/route.py", line 47, in resync
 self.routes = read_routes()
 ^^^^^^^^^^^^^
 File "/Users/mikedennis/Documents/GitHub/LANscape/.env/lib/python3.11/site-packages/scapy/arch/bpf/pfroute.py", line 1011, in read_routes
 resp = _sr1_bsdsysctl(mib)
 ^^^^^^^^^^^^^^^^^^^
 File "/Users/mikedennis/Documents/GitHub/LANscape/.env/lib/python3.11/site-packages/scapy/arch/bpf/pfroute.py", line 988, in _sr1_bsdsysctl
 return pfmsghdrs(bytes(oldp))
 ^^^^^^^^^^^^^^^^^^^^^^
 File "/Users/mikedennis/Documents/GitHub/LANscape/.env/lib/python3.11/site-packages/scapy/base_classes.py", line 481, in __call__
 i.__init__(*args, **kargs)
 File "/Users/mikedennis/Documents/GitHub/LANscape/.env/lib/python3.11/site-packages/scapy/packet.py", line 186, in __init__
 self.dissect(_pkt)
 File "/Users/mikedennis/Documents/GitHub/LANscape/.env/lib/python3.11/site-packages/scapy/packet.py", line 1102, in dissect
 s = self.do_dissect(s)
 ^^^^^^^^^^^^^^^^^^
 File "/Users/mikedennis/Documents/GitHub/LANscape/.env/lib/python3.11/site-packages/scapy/packet.py", line 1040, in do_dissect
 s, fval = f.getfield(self, s)
 ^^^^^^^^^^^^^^^^^^^
 File "/Users/mikedennis/Documents/GitHub/LANscape/.env/lib/python3.11/site-packages/scapy/fields.py", line 1836, in getfield
 raise MaximumItemsCount(
scapy.fields.MaximumItemsCount: Maximum amount of items reached in PacketListField: 4096 (defaults to conf.max_list_count)
>>> exit()

MacOS uniquely caches failed/rejected ARP lookups, causing the list of entries in the cache to grow substantially larger than other OSes when preforming network scans across a large subnet.

If i run ping 10.0.0.2, which is a valid IP in my subnet but a host does not exist at that IP, my ARP cache will show:

? (10.0.0.2) at (incomplete) on en0 ifscope [ethernet]

This behavior is unique to MacOS, I have tested on Windows and various Linux distros and they will only show entries with corresponding MAC addresses.

In summary, Scapy's hardcoded ARP cache entry limit conflicts with the ARP caching behavior on MacOS.

Note: im new to this repo and am open to suggestions on how to better implement a solution to this problem.

 

Removed the commented-out max_count calculation for PacketListField.
Copilot AI review requested due to automatic review settings January 1, 2026 02:10
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR attempts to fix an issue where Scapy fails to import on macOS when the ARP cache contains more than 4096 entries. The change removes the hardcoded max_count=4096 parameter from the pfmsghdrs PacketListField definition.

Key changes:

  • Removes the max_count=4096 parameter from the PacketListField in the pfmsghdrs class
  • Removes the associated comment explaining the calculation (65535 / len(pfmsghdr))

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Import Exception for scapy.layers.l2 on MacOS

1 participant

AltStyle によって変換されたページ (->オリジナル) /