基于Windows系统ARP欺骗的自动检测方案

Solutions of the ARP Spoofing Auto-detection Based on Windows System

针对局域网中存在的ARP欺骗现象,提出了一种自动检测方案。局域网中的主机受到ARP攻击的时候,其网关在系统ARP缓存中对应的MAC地址就会发生变化。在Windows系统中自动提取网关的IP地址,并比较该IP地址的真实MAC地址和在系统ARP缓存中对应的MAC地址,就可以判断出在网络中是否有ARP欺骗。该方案投入使用后,能够正确判断出网络中是否存在的ARP欺骗。

This text aims at a bureau area existent ARP in net to cheat phenomenon and put forward a kind of project which automatically examines. When the host in the bureau area net is mtacked, the MAC address respect to the net pass in the system ARP will change. Automatically withdrawing IP address of net pass in the Windows system, and comparing the true MAC address of that 1P address with in the system ARP slowly ~ve to in response to of MAC address, it can be judged in the network that if ARP is guiltless. This method can be applied to judge if the network affected by ARP.