Python网络安全：使用Scapy检测ARP欺骗攻击

# 使用Scapy库进行ARP欺骗攻击检测
from scapy.all import *
from tkinter import messagebox

def arp_spoofing():
    target_ip = '192.168.197.132'  # 目标主机IP地址
    target_mac = ''  # 目标主机MAC地址
    gateway_ip = '192.168.197.2'  # 网关IP地址
    gateway_mac = ''  # 网关MAC地址

    # 发送ARP请求获取目标主机MAC地址
    arp_request = ARP(pdst=target_ip)
    arp_response = sr1(arp_request, timeout=1, verbose=False)
    if arp_response:
        target_mac = arp_response.hwsrc

    # 发送ARP请求获取网关MAC地址
    arp_request = ARP(pdst=gateway_ip)
    arp_response = sr1(arp_request, timeout=1, verbose=False)
    if arp_response:
        gateway_mac = arp_response.hwsrc

    no_attack_count = 0

    # 发送ARP欺骗数据包并监听响应
    while True:
        # 向目标主机发送ARP欺骗数据包
        arp_spoofing_packet = ARP(op=2, pdst=target_ip, hwdst=target_mac, psrc=gateway_ip, hwsrc=gateway_mac)
        send(arp_spoofing_packet, verbose=False)

        # 向网关发送ARP欺骗数据包
        arp_spoofing_packet = ARP(op=2, pdst=gateway_ip, hwdst=gateway_mac, psrc=target_ip, hwsrc=target_mac)
        send(arp_spoofing_packet, verbose=False)

        # 监听响应并检测是否存在ARP欺骗攻击
        sniff_filter = 'arp and (host ' + target_ip + ' or host ' + gateway_ip + ')'
        sniff_timeout = 10
        sniff_packets = sniff(filter=sniff_filter, timeout=sniff_timeout, count=1)

        if len(sniff_packets) == 0:
            no_attack_count += 1
            if no_attack_count >= 3:
                messagebox.showinfo('提示', '未检测到ARP欺骗攻击！')
                with open('detection_log.txt', 'a') as f:
                    f.write('ARP欺骗攻击检测 - 检测结果：未检测到ARP欺骗攻击\n')
                return
        else:
            for packet in sniff_packets:
                if packet[ARP].op == 2:  # ARP响应数据包
                    if packet[ARP].psrc == target_ip and packet[ARP].hwsrc != target_mac:
                        messagebox.showwarning('警告', '检测到ARP欺骗攻击！攻击源MAC地址为' + packet[ARP].hwsrc + '，目标MAC地址为' + target_mac + '，网关MAC地址为' + gateway_mac)
                        with open('detection_log.txt', 'a') as f:
                            f.write('ARP欺骗攻击检测 - 检测结果：检测到ARP欺骗攻击\n')
                    elif packet[ARP].psrc == gateway_ip and packet[ARP].hwsrc != gateway_mac:
                        messagebox.showwarning('警告', '检测到ARP欺骗攻击！攻击源MAC地址为' + packet[ARP].hwsrc + '，目标MAC地址为' + gateway_mac + '，目标MAC地址为' + target_mac)
                        with open('detection_log.txt', 'a') as f:
                            f.write('ARP欺骗攻击检测 - 检测结果：检测到ARP欺骗攻击\n')
                    else:
                        messagebox.showinfo('提示', '未检测到ARP欺骗攻击！')
                        with open('detection_log.txt', 'a') as f:
                            f.write('ARP欺骗攻击检测 - 检测结果：未检测到ARP欺骗攻击\n')
            return


# 调用函数开始检测
arp_spoofing()