基于Linux的Python ARP攻击检测软件

这是一款功能强大的ARP攻击检测软件，运行于Linux系统，使用Python语言编写。该软件能够有效检测多种ARP攻击手段，并提供用户友好的界面和详细的攻击信息记录。

功能特点：

实时检测ARP攻击: 能够捕获并分析ARP数据包，检测多种ARP攻击手段，包括：
- 同一IP地址对应不同MAC地址
- 不同IP地址对应同一MAC地址
- 同一IP或MAC地址发出大量数据包
用户登录注册: 提供安全的登录注册功能，保护软件免受未授权访问。
扫描局域网主机: 可以扫描局域网内的活动主机，并获取其IP地址和MAC地址。
信息记录: 将所有检测到的攻击信息和扫描结果保存在日志文件中，方便用户查看和分析。

Python代码实现：

1. 捕获数据包并过滤出ARP包

import scapy.all as scapy

def capture_arp_packets():
    arp_packets = scapy.sniff(filter='arp', count=100)
    return arp_packets

2. 分析ARP包，区分正常主机和疑似异常主机

def analyze_arp_packets(arp_packets):
    normal_hosts = []
    suspicious_hosts = []
    for packet in arp_packets:
        if packet.haslayer(scapy.ARP):
            arp = packet[scapy.ARP]
            if arp.psrc == get_local_ip():
                normal_hosts.append((arp.psrc, arp.hwsrc))
            else:
                suspicious_hosts.append((arp.psrc, arp.hwsrc))
    return normal_hosts, suspicious_hosts

3. 标记疑似异常主机的IP地址和MAC地址

def print_suspicious_hosts(suspicious_hosts):
    for ip, mac in suspicious_hosts:
        print(f'�33[1;31m[!] 疑似异常主机: IP {ip}, MAC {mac}�33[0m')

4. 用户登录和注册功能

import os

def register(username, password):
    if os.path.isfile('users.txt'):
        with open('users.txt', 'r') as f:
            for line in f:
                if line.strip().split(':')[0] == username:
                    print('该用户名已注册')
                    return False
    with open('users.txt', 'a') as f:
        f.write(f'{username}:{password}
')
    print('注册成功')
    return True

def login(username, password):
    if os.path.isfile('users.txt'):
        with open('users.txt', 'r') as f:
            for line in f:
                if line.strip().split(':')[0] == username:
                    if line.strip().split(':')[1] == password:
                        print('登录成功')
                        return True
                    else:
                        print('密码错误')
                        return False
    print('用户不存在')
    return False

5. 开始/停止攻击检测和扫描局域网主机功能

import threading
import time

stop = False

def start_attack_detection():
    global stop
    stop = False
    while not stop:
        arp_packets = capture_arp_packets()
        normal_hosts, suspicious_hosts = analyze_arp_packets(arp_packets)
        print_suspicious_hosts(suspicious_hosts)
        with open('log.txt', 'a') as f:
            f.write(f'正常主机: {normal_hosts}
疑似异常主机: {suspicious_hosts}
')
        time.sleep(1)

def stop_attack_detection():
    global stop
    stop = True

def scan_hosts():
    arp_packets = scapy.srp(scapy.Ether(dst='ff:ff:ff:ff:ff:ff')/scapy.ARP(pdst=get_local_ip() + '/24'), timeout=2, verbose=False)[0]
    hosts = []
    for packet in arp_packets:
        host = packet[1].psrc, packet[1].hwsrc
        hosts.append(host)
    with open('hosts.txt', 'w') as f:
        for host in hosts:
            f.write(f'{host[0]}:{host[1]}
')
    print(f'扫描完成，共发现 {len(hosts)} 台主机')

6. 检测ARP应答包中同一IP地址对应不同MAC地址

def check_reply_packets(arp_packets):
    ip_mac_dict = {}
    for packet in arp_packets:
        if packet.haslayer(scapy.ARP) and packet[scapy.ARP].op == 2:
            ip = packet[scapy.ARP].psrc
            mac = packet[scapy.ARP].hwsrc
            if ip in ip_mac_dict and ip_mac_dict[ip] != mac:
                return True
            else:
                ip_mac_dict[ip] = mac
    return False

7. 检测ARP请求包是否合法以及是否存在不同IP地址对应同一MAC地址

def check_request_packets(arp_packets):
    ip_mac_dict = {}
    for packet in arp_packets:
        if packet.haslayer(scapy.ARP) and packet[scapy.ARP].op == 1:
            ip = packet[scapy.ARP].pdst
            mac = packet[scapy.ARP].hwsrc
            if ip in ip_mac_dict and ip_mac_dict[ip] != mac:
                return True
            else:
                ip_mac_dict[ip] = mac
    return False

8. 检测ARP泛洪攻击

def check_arp_flood(arp_packets):
    ip_count_dict = {}
    mac_count_dict = {}
    for packet in arp_packets:
        if packet.haslayer(scapy.ARP):
            ip = packet[scapy.ARP].psrc
            mac = packet[scapy.ARP].hwsrc
            if ip in ip_count_dict:
                ip_count_dict[ip] += 1
                if ip_count_dict[ip] > 10:
                    return True
            else:
                ip_count_dict[ip] = 1
            if mac in mac_count_dict:
                mac_count_dict[mac] += 1
                if mac_count_dict[mac] > 10:
                    return True
            else:
                mac_count_dict[mac] = 1
    return False

9. 主程序入口

def main():
    username = input('用户名: ')
    password = input('密码: ')
    if not login(username, password):
        return
    while True:
        print('1. 开始攻击检测')
        print('2. 停止攻击检测')
        print('3. 扫描主机')
        choice = input('请选择: ')
        if choice == '1':
            t = threading.Thread(target=start_attack_detection)
            t.start()
        elif choice == '2':
            stop_attack_detection()
        elif choice == '3':
            scan_hosts()
        else:
            break

if __name__ == '__main__':
    main()

总结

这款基于Linux的Python ARP攻击检测软件功能强大，代码简洁易懂，能够有效帮助用户保护网络安全。用户可以根据自身需求对代码进行修改和扩展，打造更加个性化的网络安全工具。