基于Winpcap的网关型ARP病毒防御系统的实现

Realization of ARP Cheating Attack at Gateways Defence System based on the Winpcap

根据网关型ARP欺骗病毒的特点,通过在客服端中保存真实的网关MAC地址,周期性地向网关发ARP报文确保与其通信正常,并检测ARP表中网关MAC地址是否被改写的方法,利用winpcap开发库设计了一个针对该病毒的防御软件。该软件无需增加硬件设备,界面简单易用,且运行速度快,较好地解决了网关型ARP欺骗病毒对主机的影响,有一定的实用价值。

By analyzing the characteristics of ARP—cheating attack at the gateway,in the service of preservation of real gateway MAC address,Periodically send message to the gateway to ensure the ARP gateway to normal,and communication of ARP table testing whether the MAC address is rewriting the gateway to the method,Use a library winpcap development design of the virus in defence software.It is easy and quick,andneeds no extra equipment and To better solve the gateway to host ARP deception virus type,have certain practical value.