Python ARP Spoofing Attack Detection Function - detect_attack()
The function detect_attack() reads a file named 'clients.txt' containing a list of clients' IP addresses and MAC addresses. For each client, it uses the get_mac() function to obtain the MAC address and sets a filter to sniff for ARP packets originating from that client's IP. It captures packets for 10 seconds and checks if any captured packets are ARP response packets. If it finds an ARP response with a source MAC address that doesn't match the client's MAC and isn't all zeros, it issues a warning message indicating a spoofed source attack. This warning is also logged in a file named 'detection_log.txt'. If more than 100 packets are captured, it raises a warning message indicating an attack from the client's IP and MAC address. Fewer than 100 packets trigger an information message stating that no attack source was detected. The function then concludes without further action.
There's a typo in the last line of the function. The return statement is redundant and should be removed. The comment before the return statement is also incorrect; it should state that no attack source was detected instead of claiming that an attack source has not been detected.
原文地址: https://www.cveoy.top/t/topic/jojU 著作权归作者所有。请勿转载和采集!