3

I have created a python script to detect an ARP attack. I have already initiated a ARP spoof attack and stored the wireshark capture in a pcap file. Once the code is executed, the code is designed to alert of any possible attack based on the MAC value change.

But how do I create a dictionary in the first place to store the MAC--IP mappings, and then detect when there is a change of values to indicate an alert?

Can anyone guide me please?

from scapy.all import *

mac_table = {}
def main():  
    pkts = rdpcap('/root/Desktop/arp_capture.pcap')
    for packet in pkts: 
        if packet.haslayer(ARP):
        
            if packet[ARP].op == 2:
                try:
                
                    original_mac = req_mac(packet[ARP].psrc)
                
                    new_mac = packet[ARP].hwsrc
                
                    if original_mac != new_mac:
                        print(f"[**] ATTACK ALERT !!!!!! CHECK ARP TABLES !!![**]")
                except IndexError:
                
                    pass

def req_mac(ip):
    
    arp_req = ARP(pdst=ip)
    bcst_req = Ether(dst='ff:ff:ff:ff:ff:ff')
    p = bcst_req/arp_req
    
    result = srp(p, timeout=3, verbose=False)[0]
    return result[0][1].hwsrc


if __name__ == "__main__":
    main()
koshila_dodan
  • 49
  • 1
  • 3

0 Answers0