from scapy.all import sniff, ARP
def arp_detect(pkt):
if pkt[ARP].op == 2: # ARP响应
real_mac = get_mac(pkt[ARP].psrc)
response_mac = pkt[ARP].hwsrc
if real_mac != response_mac:
print(f"ARP欺骗检测: {pkt[ARP].psrc} 声称是 {response_mac}")
def get_mac(ip):
# 实现获取IP对应真实MAC地址的逻辑
pass
sniff(prn=arp_detect, filter="arp", store=0)