This Python code uses the Scapy library to perform ARP (Address Resolution Protocol) monitoring on a network interface specified as "eth0." Here's a summary of what each part of the code does:

1. **Importing Scapy:**
```python
from scapy.all import sniff
```
Imports the `sniff` function from the Scapy library.

2. **Global Variable:**
```python
IP_MAC_Map = {}
```
Initializes an empty dictionary (`IP_MAC_Map`) to store the mapping between IP addresses and MAC addresses.

3. **Packet Processing Function:**
```python
def processPacket(packet):
```
Defines a function (`processPacket`) to process each captured packet.

```python
src_IP = packet['ARP'].psrc
src_MAC = packet['Ether'].src
```
Extracts the source IP address and MAC address from the ARP packet.

```python
if src_MAC in IP_MAC_Map.keys():
# Check if the MAC address is already in the mapping
if IP_MAC_Map[src_MAC] != src_IP:
# If the IP address associated with the MAC address is different, potential ARP attack
try:
old_IP = IP_MAC_Map[src_MAC]
except:
old_IP = "unknown"

message = ("\n Possible ARP attack detected \n "
+ "It is possible that the machine with IP address \n "
+ str(old_IP) + " is pretending to be " + str(src_IP)
+ "\n ")
return message
else:
# If MAC address is not in the mapping, add it to the dictionary
IP_MAC_Map[src_MAC] = src_IP
```
Checks whether the source MAC address is already in the mapping (`IP_MAC_Map`). If it is, it compares the stored IP address with the current packet's source IP address. If they are different, it indicates a possible ARP attack, and a message is constructed.

4. **ARP Sniffing:**
```python
sniff(count=0, filter="arp", store=0, prn=processPacket, iface="eth0")
```
Uses Scapy's `sniff` function to capture ARP packets on the specified interface ("eth0"). The `processPacket` function is called for each captured packet.

In summary, this code monitors ARP traffic on the specified network interface, maintains a mapping between IP and MAC addresses, and raises a potential ARP attack alert if it detects a discrepancy between the IP address associated with a MAC address and the one observed in a new packet.

свернуть