I’ve used scapy for years and found it especially useful when performing internal penetration tests. It has useful patterns for tasks like quickly putting together a custom DNS server, UDP source spoofing, walking all ICMP codes (or a quick and dirty ICMP redirect tool), or couple it with matplotlib and to estimate how many active hosts are communicating with a remote server based on TCP sequence numbers (I believe this is part of the scapy examples.)

Coupled with interfaces to import and export PCAP files, it’s also a great way to learn about or explore/tamper with network protocols.

The fact that it’s implemented in Python might scare some off, but I personally feel that this only adds to its usefulness since it can benefit from all of the external tooling and flexibility that comes with the language.