网络安全检测工具：ARP欺骗、ICMP泛洪、TCP攻击和网络扫描

import tkinter as tk
import os
import sys
import time
import threading
import netifaces
from scapy.all import *
from scapy.layers.l2 import ARP
from tkinter import messagebox
from scapy.layers.l2 import getmacbyip
from scapy.layers.inet import IP, ICMP
from scapy.layers.inet import TCP

class DetectionPage:
    def __init__(self, master, timeout, detection_type):
        self.master = master
        self.timeout = timeout
        self.detection_type = detection_type
        self.interface = 'ens33'
        self.target_ip = '192.168.197.1'  # 默认目标IP，可根据实际情况修改
        self.thread = None
        self.stop_event = threading.Event()
        self.timer = 0

        self.frame = tk.Frame(self.master)
        self.frame.pack()

        self.status_label = tk.Label(self.frame, text='Idle')
        self.status_label.pack()

        self.start_button = tk.Button(self.frame, text='Start', command=self.start_detection)
        self.start_button.pack()

        self.stop_button = tk.Button(self.frame, text='Stop', command=self.stop_detection, state=tk.DISABLED)
        self.stop_button.pack()

    def start_detection(self):
        self.status_label.config(text='Running')
        self.start_button.config(state=tk.DISABLED)
        self.stop_button.config(state=tk.NORMAL)
        self.timer = 0
        self.stop_event.clear()
        self.thread = threading.Thread(target=self.run)
        self.thread.start()

    def stop_detection(self):
        self.status_label.config(text='Idle')
        self.start_button.config(state=tk.NORMAL)
        self.stop_button.config(state=tk.DISABLED)
        self.stop_event.set()
        self.thread.join()

    def run(self):
        while not self.stop_event.is_set():
            if self.detection_type == 'ARP':
                self.detect_arp_spoofing()
            elif self.detection_type == 'ICMP':
                self.detect_icmp_flood()
            elif self.detection_type == 'TCP':
                self.detect_tcp_attack()
            time.sleep(5)
            self.timer += 5
            if self.timer >= self.timeout:
                print(f'No {self.detection_type} attack detected')
                self.stop_event.set()

    def detect_arp_spoofing(self):
        attacker_ip = netifaces.ifaddresses(self.interface)[netifaces.AF_INET][0]['addr']
        attacker_mac = getmacbyip(attacker_ip)
        print(f'Attacker IP: {attacker_ip}, MAC: {attacker_mac}')
        ip_mac_map = {}
        for ip in netifaces.ifaddresses(self.interface)[netifaces.AF_INET][0]['addr'].split('.')[:-1]:
            for i in range(1, 255):
                target_ip = f'{ip}.{i}'
                if target_ip != attacker_ip:
                    arp_request = ARP(pdst=target_ip)
                    arp_reply = sr1(arp_request, timeout=1, verbose=0)
                    if arp_reply and arp_reply.hwsrc not in ('00:00:00:00:00:00', attacker_mac):
                        ip_mac_map[target_ip] = arp_reply.hwsrc
        for target_ip, target_mac in ip_mac_map.items():
            arp_request = ARP(op=1, pdst=target_ip, hwdst=target_mac, psrc=attacker_ip, hwsrc=attacker_mac)
            arp_reply = sr1(arp_request, timeout=1, verbose=0)
            if arp_reply and arp_reply.hwsrc != target_mac:
                print(f'ARP spoofing detected: {target_ip} ({target_mac}) -> {arp_reply.hwsrc}')

    def detect_icmp_flood(self):
        icmp_request = IP(dst=self.target_ip)/ICMP()
        icmp_reply = sr1(icmp_request, timeout=1, verbose=0)
        if icmp_reply:
            print(f'ICMP flood detected: {icmp_reply.src} -> {icmp_reply.dst}')

    def detect_tcp_attack(self):
        tcp_request = IP(dst=self.target_ip)/TCP(flags='S')  # 发送SYN包
        tcp_reply = sr1(tcp_request, timeout=1, verbose=0)
        if tcp_reply and tcp_reply.haslayer(TCP) and tcp_reply[TCP].flags == 'SA':  # 判断是否收到SYN/ACK包
            print(f'TCP SYN scan detected: {tcp_reply.src} -> {tcp_reply.dst}')

class NetworkScannerPage:
    def __init__(self, master):
        self.master = master
        self.interface = 'ens33'
        self.ip_mac_map = {}

        self.frame = tk.Frame(self.master)
        self.frame.pack()

        self.scan_button = tk.Button(self.frame, text='Scan', command=self.scan_network)
        self.scan_button.pack()

        self.result_label = tk.Label(self.frame, text='')
        self.result_label.pack()

    def scan_network(self):
        self.ip_mac_map = {}
        for ip in netifaces.ifaddresses(self.interface)[netifaces.AF_INET][0]['addr'].split('.')[:-1]:
            for i in range(1, 255):
                target_ip = f'{ip}.{i}'
                arp_request = ARP(pdst=target_ip)
                arp_reply = sr1(arp_request, timeout=1, verbose=0)
                if arp_reply and arp_reply.hwsrc not in ('00:00:00:00:00:00', get_if_hwaddr(self.interface)):
                    self.ip_mac_map[target_ip] = arp_reply.hwsrc

        result = ''
        for ip, mac in self.ip_mac_map.items():
            result += f'{ip} ({mac})
'
        self.result_label.config(text=result)

class MainWindow:
    def __init__(self):
        self.root = tk.Tk()
        self.root.title('网络安全检测工具')
        self.root.geometry('400x350')

        self.timeout_label = tk.Label(self.root, text='检测时间 (秒):')
        self.timeout_label.pack()

        self.timeout_entry = tk.Entry(self.root)
        self.timeout_entry.insert(0, '60')  # 默认检测时间为60秒
        self.timeout_entry.pack()

        self.arp_button = tk.Button(self.root, text='ARP 欺骗检测', command=self.show_arp_page)
        self.arp_button.pack()

        self.icmp_button = tk.Button(self.root, text='ICMP 泛洪检测', command=self.show_icmp_page)
        self.icmp_button.pack()

        self.tcp_button = tk.Button(self.root, text='TCP 攻击检测', command=self.show_tcp_page)
        self.tcp_button.pack()

        self.network_button = tk.Button(self.root, text='网络扫描', command=self.show_network_page)
        self.network_button.pack()

        self.root.mainloop()

    def show_arp_page(self):
        timeout = int(self.timeout_entry.get())
        arp_page = tk.Toplevel(self.root)
        arp_page.title('ARP 欺骗检测')
        DetectionPage(arp_page, timeout, 'ARP')

    def show_icmp_page(self):
        timeout = int(self.timeout_entry.get())
        icmp_page = tk.Toplevel(self.root)
        icmp_page.title('ICMP 泛洪检测')
        DetectionPage(icmp_page, timeout, 'ICMP')

    def show_tcp_page(self):
        timeout = int(self.timeout_entry.get())
        tcp_page = tk.Toplevel(self.root)
        tcp_page.title('TCP 攻击检测')
        DetectionPage(tcp_page, timeout, 'TCP')

    def show_network_page(self):
        network_page = tk.Toplevel(self.root)
        network_page.title('网络扫描')
        NetworkScannerPage(network_page)

if __name__ == '__main__':
    MainWindow()