如何用代码实现ARP检测

ARP检测可以通过以下步骤实现：

1. 获取本机的IP地址和MAC地址。

2. 构造一个ARP请求包，并设置目标IP地址为本机的IP地址。

3. 发送ARP请求包到本地网络中，并等待一定时间，等待其他主机响应。

4. 接收其他主机的ARP响应包，并检查响应包中的MAC地址是否与目标IP地址对应的MAC地址一致。

下面是一个简单的Python代码实现ARP检测：

import os
import sys
import struct
import socket
import fcntl
import time

# 获取本机IP地址和MAC地址
def get_local_ip_mac(ifname):
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    local_ip = socket.inet_ntoa(fcntl.ioctl(
        s.fileno(),
        0x8915,
        struct.pack('256s', ifname[:15].encode())
    )[20:24])
    local_mac = fcntl.ioctl(s.fileno(), 0x8927, struct.pack('256s', ifname[:15].encode()))[18:24]
    return local_ip, local_mac

# 构造ARP请求包
def build_arp_request(local_ip, local_mac, target_ip):
    eth_hdr = struct.pack("!6s6s2s", b"\xff\xff\xff\xff\xff\xff", local_mac, b"\x08\x06")
    arp_hdr = struct.pack("!2s2s1s1s2s", b"\x00\x01", b"\x08\x00", b"\x06", b"\x04", b"\x00\x01")
    arp_sender = struct.pack("!6s4s", local_mac, socket.inet_aton(local_ip))
    arp_target = struct.pack("!6s4s", b"\x00\x00\x00\x00\x00\x00", socket.inet_aton(target_ip))
    arp_packet = eth_hdr + arp_hdr + arp_sender + arp_target
    return arp_packet

# 发送ARP请求包
def send_arp_request(arp_packet, interface):
    s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.SOCK_RAW)
    s.bind((interface, socket.SOCK_RAW))
    s.send(arp_packet)

# 接收ARP响应包
def recv_arp_response():
    s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.SOCK_RAW)
    while True:
        packet = s.recvfrom(65535)[0]
        eth_hdr = struct.unpack("!6s6s2s", packet[:14])
        if eth_hdr[2] == b"\x08\x06":
            arp_hdr = struct.unpack("!2s2s1s1s2s", packet[14:28])
            if arp_hdr[4] == b"\x00\x02":
                return eth_hdr[0], arp_hdr[3]

# 检测ARP是否被欺骗
def arp_detect(ifname, target_ip):
    local_ip, local_mac = get_local_ip_mac(ifname)
    arp_packet = build_arp_request(local_ip, local_mac, target_ip)
    send_arp_request(arp_packet, ifname)
    time.sleep(1)
    res_mac = recv_arp_response()[1]
    if res_mac != local_mac:
        print("ARP欺骗已检测到！")
    else:
        print("ARP正常！")

# 调用arp_detect函数进行检测
arp_detect("eth0", "192.168.1.1")

需要注意的是，该代码只能检测本地网络中的ARP欺骗，如果要检测跨网络的ARP欺骗，需要进行更复杂的操作