• 日期: 2028-07-21
  • 标签: 常规

以下是一个简单的基于Python的ARP欺骗检测软件的实现，包括icmp flood、tcp攻击和ARP欺骗攻击检测：

  1. 首先安装必要的Python库：
pip install scapy
pip install netifaces
pip install tkinter
  1. 编写ARP欺骗检测模块：
import os
import sys
import time
import threading
import netifaces
from scapy.all import *


class ArpDetector:
    '初始化ARP欺骗检测器'
    def __init__(self, interface):
        self.interface = interface
        self.ip_mac_map = {}
        self.attacker_ip = None
        self.attacker_mac = None
        self.thread = None
        self.stop_event = threading.Event()

    '启动检测线程'
    def start(self):
        self.thread = threading.Thread(target=self.run)
        self.thread.start()

    '停止检测线程'
    def stop(self):
        self.stop_event.set()
        self.thread.join()

    '运行检测循环'
    def run(self):
        self.attacker_ip = netifaces.ifaddresses(self.interface)[netifaces.AF_INET][0]['addr']
        self.attacker_mac = get_mac_address(ip=self.attacker_ip)
        print(f'Attacker IP: {self.attacker_ip}, MAC: {self.attacker_mac}')

        while not self.stop_event.is_set():
            self.scan_network()
            self.detect_arp_spoofing()
            time.sleep(5)

    '扫描局域网内的主机'
    def scan_network(self):
        for ip in netifaces.ifaddresses(self.interface)[netifaces.AF_INET][0]['addr'].split('.')[:-1]:
            for i in range(1, 255):
                target_ip = f'{ip}.{i}'
                if target_ip != self.attacker_ip:
                    arp_request = ARP(pdst=target_ip)
                    arp_reply = sr1(arp_request, timeout=1, verbose=0)
                    if arp_reply and arp_reply.hwsrc not in ('00:00:00:00:00:00', self.attacker_mac):
                        self.ip_mac_map[target_ip] = arp_reply.hwsrc

    '检测ARP欺骗攻击'
    def detect_arp_spoofing(self):
        for target_ip, target_mac in self.ip_mac_map.items():
            arp_request = ARP(op=1, pdst=target_ip, hwdst=target_mac, psrc=self.attacker_ip, hwsrc=self.attacker_mac)
            arp_reply = sr1(arp_request, timeout=1, verbose=0)
            if arp_reply and arp_reply.hwsrc != target_mac:
                print(f'ARP spoofing detected: {target_ip} ({target_mac}) -> {arp_reply.hwsrc}')
  1. 编写icmp flood攻击检测模块：
class IcmpFloodDetector:
    '初始化ICMP洪泛攻击检测器'
    def __init__(self, interface):
        self.interface = interface
        self.attacker_ip = None
        self.thread = None
        self.stop_event = threading.Event()

    '启动检测线程'
    def start(self):
        self.thread = threading.Thread(target=self.run)
        self.thread.start()

    '停止检测线程'
    def stop(self):
        self.stop_event.set()
        self.thread.join()

    '运行检测循环'
    def run(self):
        self.attacker_ip = netifaces.ifaddresses(self.interface)[netifaces.AF_INET][0]['addr']
        print(f'Attacker IP: {self.attacker_ip}')

        while not self.stop_event.is_set():
            self.detect_icmp_flood()
            time.sleep(5)

    '检测ICMP洪泛攻击'
    def detect_icmp_flood(self):
        icmp_packets = sniff(filter=f'icmp and src host {self.attacker_ip}', timeout=1, count=10)
        if len(icmp_packets) == 10:
            print('ICMP flood detected')
  1. 编写tcp攻击检测模块：
class TcpAttackDetector:
    '初始化TCP攻击检测器'
    def __init__(self, interface):
        self.interface = interface
        self.attacker_ip = None
        self.thread = None
        self.stop_event = threading.Event()

    '启动检测线程'
    def start(self):
        self.thread = threading.Thread(target=self.run)
        self.thread.start()

    '停止检测线程'
    def stop(self):
        self.stop_event.set()
        self.thread.join()

    '运行检测循环'
    def run(self):
        self.attacker_ip = netifaces.ifaddresses(self.interface)[netifaces.AF_INET][0]['addr']
        print(f'Attacker IP: {self.attacker_ip}')

        while not self.stop_event.is_set():
            self.detect_tcp_attack()
            time.sleep(5)

    '检测TCP攻击'
    def detect_tcp_attack(self):
        tcp_packets = sniff(filter=f'tcp and src host {self.attacker_ip}', timeout=1, count=10)
        if len(tcp_packets) == 10:
            print('TCP attack detected')
  1. 编写局域网扫描和记录模块：
class NetworkScanner:
    '初始化局域网扫描器'
    def __init__(self, interface):
        self.interface = interface
        self.ip_mac_map = {}
        self.thread = None
        self.stop_event = threading.Event()

    '启动扫描线程'
    def start(self):
        self.thread = threading.Thread(target=self.run)
        self.thread.start()

    '停止扫描线程'
    def stop(self):
        self.stop_event.set()
        self.thread.join()

    '运行扫描循环'
    def run(self):
        while not self.stop_event.is_set():
            self.scan_network()
            time.sleep(10)

    '扫描局域网内的主机'
    def scan_network(self):
        for ip in netifaces.ifaddresses(self.interface)[netifaces.AF_INET][0]['addr'].split('.')[:-1]:
            for i in range(1, 255):
                target_ip = f'{ip}.{i}'
                if target_ip not in self.ip_mac_map:
                    arp_request = ARP(pdst=target_ip)
                    arp_reply = sr1(arp_request, timeout=1, verbose=0)
                    if arp_reply and arp_reply.hwsrc not in ('00:00:00:00:00:00', 'ff:ff:ff:ff:ff:ff'):
                        self.ip_mac_map[target_ip] = arp_reply.hwsrc
                        print(f'Found: {target_ip} ({arp_reply.hwsrc})')
                        self.save_to_file(target_ip, arp_reply.hwsrc)

    '将扫描结果保存到文件'
    def save_to_file(self, ip, mac):
        with open('network_scan.txt', 'a') as f:
            f.write(f'{ip},{mac}
')
  1. 编写用户登录和注册界面：
import tkinter as tk


class LoginWindow:
    '初始化登录窗口'
    def __init__(self):
        self.root = tk.Tk()
        self.root.title('Login')
        self.root.geometry('300x150')

        tk.Label(self.root, text='Username').place(x=50, y=30)
        self.username_entry = tk.Entry(self.root)
        self.username_entry.place(x=120, y=30)

        tk.Label(self.root, text='Password').place(x=50, y=60)
        self.password_entry = tk.Entry(self.root, show='*')
        self.password_entry.place(x=120, y=60)

        self.login_button = tk.Button(self.root, text='Login', command=self.login)
        self.login_button.place(x=100, y=100)

        self.register_button = tk.Button(self.root, text='Register', command=self.register)
        self.register_button.place(x=170, y=100)

        self.root.mainloop()

    '登录按钮点击事件'
    def login(self):
        username = self.username_entry.get()
        password = self.password_entry.get()
        # TODO: 实现用户登录逻辑

    '注册按钮点击事件'
    def register(self):
        username = self.username_entry.get()
        password = self.password_entry.get()
        # TODO: 实现用户注册逻辑


class MainWindow:
    '初始化主窗口'
    def __init__(self):
        self.root = tk.Tk()
        self.root.title('ARP Detector')
        self.root.geometry('400x300')

        self.status_label = tk.Label(self.root, text='Idle')
        self.status_label.pack()

        self.start_button = tk.Button(self.root, text='Start', command=self.start_detection)
        self.start_button.pack()

        self.stop_button = tk.Button(self.root, text='Stop', command=self.stop_detection, state=tk.DISABLED)
        self.stop_button.pack()

        self.root.mainloop()

    '启动检测按钮点击事件'
    def start_detection(self):
        self.status_label.config(text='Running')
        self.start_button.config(state=tk.DISABLED)
        self.stop_button.config(state=tk.NORMAL)

        self.arp_detector = ArpDetector('eth0')
        self.arp_detector.start()

        self.icmp_flood_detector = IcmpFloodDetector('eth0')
        self.icmp_flood_detector.start()

        self.tcp_attack_detector = TcpAttackDetector('eth0')
        self.tcp_attack_detector.start()

        self.network_scanner = NetworkScanner('eth0')
        self.network_scanner.start()

    '停止检测按钮点击事件'
    def stop_detection(self):
        self.status_label.config(text='Idle')
        self.start_button.config(state=tk.NORMAL)
        self.stop_button.config(state=tk.DISABLED)

        self.arp_detector.stop()
        self.icmp_flood_detector.stop()
        self.tcp_attack_detector.stop()
        self.network_scanner.stop()
  1. 在主程序中集成所有模块和界面：
if __name__ == '__main__':
    login_window = LoginWindow()
    main_window = MainWindow()

完整代码如下：

import os
import sys
import time
import threading
import netifaces
from scapy.all import *
import tkinter as tk


class ArpDetector:
    '初始化ARP欺骗检测器'
    def __init__(self, interface):
        self.interface = interface
        self.ip_mac_map = {}
        self.attacker_ip = None
        self.attacker_mac = None
        self.thread = None
        self.stop_event = threading.Event()

    '启动检测线程'
    def start(self):
        self.thread = threading.Thread(target=self.run)
        self.thread.start()

    '停止检测线程'
    def stop(self):
        self.stop_event.set()
        self.thread.join()

    '运行检测循环'
    def run(self):
        self.attacker_ip = netifaces.ifaddresses(self.interface)[netifaces.AF_INET][0]['addr']
        self.attacker_mac = get_mac_address(ip=self.attacker_ip)
        print(f'Attacker IP: {self.attacker_ip}, MAC: {self.attacker_mac}')

        while not self.stop_event.is_set():
            self.scan_network()
            self.detect_arp_spoofing()
            time.sleep(5)

    '扫描局域网内的主机'
    def scan_network(self):
        for ip in netifaces.ifaddresses(self.interface)[netifaces.AF_INET][0]['addr'].split('.')[:-1]:
            for i in range(1, 255):
                target_ip = f'{ip}.{i}'
                if target_ip != self.attacker_ip:
                    arp_request = ARP(pdst=target_ip)
                    arp_reply = sr1(arp_request, timeout=1, verbose=0)
                    if arp_reply and arp_reply.hwsrc not in ('00:00:00:00:00:00', self.attacker_mac):
                        self.ip_mac_map[target_ip] = arp_reply.hwsrc

    '检测ARP欺骗攻击'
    def detect_arp_spoofing(self):
        for target_ip, target_mac in self.ip_mac_map.items():
            arp_request = ARP(op=1, pdst=target_ip, hwdst=target_mac, psrc=self.attacker_ip, hwsrc=self.attacker_mac)
            arp_reply = sr1(arp_request, timeout=1, verbose=0)
            if arp_reply and arp_reply.hwsrc != target_mac:
                print(f'ARP spoofing detected: {target_ip} ({target_mac}) -> {arp_reply.hwsrc}')


class IcmpFloodDetector:
    '初始化ICMP洪泛攻击检测器'
    def __init__(self, interface):
        self.interface = interface
        self.attacker_ip = None
        self.thread = None
        self.stop_event = threading.Event()

    '启动检测线程'
    def start(self):
        self.thread = threading.Thread(target=self.run)
        self.thread.start()

    '停止检测线程'
    def stop(self):
        self.stop_event.set()
        self.thread.join()

    '运行检测循环'
    def run(self):
        self.attacker_ip = netifaces.ifaddresses(self.interface)[netifaces.AF_INET][0]['addr']
        print(f'Attacker IP: {self.attacker_ip}')

        while not self.stop_event.is_set():
            self.detect_icmp_flood()
            time.sleep(5)

    '检测ICMP洪泛攻击'
    def detect_icmp_flood(self):
        icmp_packets = sniff(filter=f'icmp and src host {self.attacker_ip}', timeout=1, count=10)
        if len(icmp_packets) == 10:
            print('ICMP flood detected')


class TcpAttackDetector:
    '初始化TCP攻击检测器'
    def __init__(self, interface):
        self.interface = interface
        self.attacker_ip = None
        self.thread = None
        self.stop_event = threading.Event()

    '启动检测线程'
    def start(self):
        self.thread = threading.Thread(target=self.run)
        self.thread.start()

    '停止检测线程'
    def stop(self):
        self.stop_event.set()
        self.thread.join()

    '运行检测循环'
    def run(self):
        self.attacker_ip = netifaces.ifaddresses(self.interface)[netifaces.AF_INET][0]['addr']
        print(f'Attacker IP: {self.attacker_ip}')

        while not self.stop_event.is_set():
            self.detect_tcp_attack()
            time.sleep(5)

    '检测TCP攻击'
    def detect_tcp_attack(self):
        tcp_packets = sniff(filter=f'tcp and src host {self.attacker_ip}', timeout=1, count=10)
        if len(tcp_packets) == 10:
            print('TCP attack detected')


class NetworkScanner:
    '初始化局域网扫描器'
    def __init__(self, interface):
        self.interface = interface
        self.ip_mac_map = {}
        self.thread = None
        self.stop_event = threading.Event()

    '启动扫描线程'
    def start(self):
        self.thread = threading.Thread(target=self.run)
        self.thread.start()

    '停止扫描线程'
    def stop(self):
        self.stop_event.set()
        self.thread.join()

    '运行扫描循环'
    def run(self):
        while not self.stop_event.is_set():
            self.scan_network()
            time.sleep(10)

    '扫描局域网内的主机'
    def scan_network(self):
        for ip in netifaces.ifaddresses(self.interface)[netifaces.AF_INET][0]['addr'].split('.')[:-1]:
            for i in range(1, 255):
                target_ip = f'{ip}.{i}'
                if target_ip not in self.ip_mac_map:
                    arp_request = ARP(pdst=target_ip)
                    arp_reply = sr1(arp_request, timeout=1, verbose=0)
                    if arp_reply and arp_reply.hwsrc not in ('00:00:00:00:00:00', 'ff:ff:ff:ff:ff:ff'):
                        self.ip_mac_map[target_ip] = arp_reply.hwsrc
                        print(f'Found: {target_ip} ({arp_reply.hwsrc})')
                        self.save_to_file(target_ip, arp_reply.hwsrc)

    '将扫描结果保存到文件'
    def save_to_file(self, ip, mac):
        with open('network_scan.txt', 'a') as f:
            f.write(f'{ip},{mac}
')


class LoginWindow:
    '初始化登录窗口'
    def __init__(self):
        self.root = tk.Tk()
        self.root.title('Login')
        self.root.geometry('300x150')

        tk.Label(self.root, text='Username').place(x=50, y=30)
        self.username_entry = tk.Entry(self.root)
        self.username_entry.place(x=120, y=30)

        tk.Label(self.root, text='Password').place(x=50, y=60)
        self.password_entry = tk.Entry(self.root, show='*')
        self.password_entry.place(x=120, y=60)

        self.login_button = tk.Button(self.root, text='Login', command=self.login)
        self.login_button.place(x=100, y=100)

        self.register_button = tk.Button(self.root, text='Register', command=self.register)
        self.register_button.place(x=170, y=100)

        self.root.mainloop()

    '登录按钮点击事件'
    def login(self):
        username = self.username_entry.get()
        password = self.password_entry.get()
        # TODO: 实现用户登录逻辑

    '注册按钮点击事件'
    def register(self):
        username = self.username_entry.get()
        password = self.password_entry.get()
        # TODO: 实现用户注册逻辑


class MainWindow:
    '初始化主窗口'
    def __init__(self):
        self.root = tk.Tk()
        self.root.title('ARP Detector')
        self.root.geometry('400x300')

        self.status_label = tk.Label(self.root, text='Idle')
        self.status_label.pack()

        self.start_button = tk.Button(self.root, text='Start', command=self.start_detection)
        self.start_button.pack()

        self.stop_button = tk.Button(self.root, text='Stop', command=self.stop_detection, state=tk.DISABLED)
        self.stop_button.pack()

        self.root.mainloop()

    '启动检测按钮点击事件'
    def start_detection(self):
        self.status_label.config(text='Running')
        self.start_button.config(state=tk.DISABLED)
        self.stop_button.config(state=tk.NORMAL)

        self.arp_detector = ArpDetector('eth0')
        self.arp_detector.start()

        self.icmp_flood_detector = IcmpFloodDetector('eth0')
        self.icmp_flood_detector.start()

        self.tcp_attack_detector = TcpAttackDetector('eth0')
        self.tcp_attack_detector.start()

        self.network_scanner = NetworkScanner('eth0')
        self.network_scanner.start()

    '停止检测按钮点击事件'
    def stop_detection(self):
        self.status_label.config(text='Idle')
        self.start_button.config(state=tk.NORMAL)
        self.stop_button.config(state=tk.DISABLED)

        self.arp_detector.stop()
        self.icmp_flood_detector.stop()
        self.tcp_attack_detector.stop()
        self.network_scanner.stop()


if __name__ == '__main__':
    login_window = LoginWindow()
    main_window = MainWindow()
Python ARP欺骗检测软件 - 实时监控网络攻击，并记录局域网信息

原文地址: https://www.cveoy.top/t/topic/jnSJ 著作权归作者所有。请勿转载和采集!

免费AI点我,无需注册和登录