摘要
传统的数据嗅探方法不能在交换式局域网环境下实现。在分析了局域网的共享环境和交换环境各自特点后,基于地址解析协议ARP的工作原理,提出一种利用ARP欺骗实现中间人攻击,从而实现交换环境数据嗅探的方法。利用WinPcap驱动实现的嗅探软件降低了对操作系统版本的依赖程度,整个过程包括了ARP欺骗和欺骗后的恢复,以及数据嗅探和数据转发功能。实验表明利用ARP欺骗所实现的数据嗅探完全能够在交换式的局域网中工作,并且不会中断被攻击主机之间的正常通信。
Traditional methods of packet sniffing can＇t be realized in switched ethernet. After differences between shared and switched Ethernet environment is introduced, based on the principle of ARP, a kind ofman-in-the-middle-attacks method in switched Ethernet is brought forward by ARP spoofmg, and packet sniffing is realized. The sniffer realized by WinPcap driver, which decreases the dependency of OS, and the whole progress includes ARP spoofing, recovery after ARP spoofing, packets Sniffing and forward. The experiment proves packet sniffering realized by ARP spoofing can work completely in switched Ethernet, and communications between targets won＇t be broken.
出处
《计算机工程与设计》
CSCD
北大核心
2007年第10期2326-2328,共3页
Computer Engineering and Design
基金
西南科技大学基金项目(06zx3154)
