linux arp攻击检测

sudo apt-get install arpwatch
sudo arpwatch -i eth0 -n

sudo apt-get install arp-scan
sudo arp-scan --localnet

sudo iptables -A INPUT -p arp --arp-op Request -m mac --mac-source XX:XX:XX:XX:XX:XX -j DROP

import scapy.all as scapy

def scan(ip):
    arp_request = scapy.ARP(pdst=ip)
    broadcast = scapy.Ether(dst="ff:ff:ff:ff:ff:ff")
    arp_request_broadcast = broadcast/arp_request
    answered_list = scapy.srp(arp_request_broadcast, timeout=1, verbose=False)[0]

    clients_list = []
    for element in answered_list:
        client_dict = {"ip": element[1].psrc, "mac": element[1].hwsrc}
        clients_list.append(client_dict)
    return clients_list

def main():
    ip_range = "192.168.1.1/24"
    clients = scan(ip_range)
    print("IP\t\tMAC Address")
    for client in clients:
        print(client["ip"] + "\t\t" + client["mac"])

if __name__ == "__main__":
    main()