ARP spoofing detection method, device and terminal in non-Root environment

Abstract

The invention discloses an ARP cheating detection method, a device and a terminal under a non-Root environment, belonging to the technical field of network security. The method comprises the followingsteps: acquiring a first network parameter by analyzing an ARP cache table and extracting a current MAC address of a target gateway; the first network parameter comprises an IP address and a currentMAC address of a target gateway obtained by parsing an ARP cache table; acquiring a second network parameter and extracting a previous MAC address of the target gateway; the second network parameter is the stored IP address of the target gateway and the last MAC address; judging whether the current MAC address of the target gateway is the same as the previous MAC address of the target gateway; ifnot, ARP spoofing is determined to be present. The detection of ARP spoofing in the invention no longer relies on the operations requiring Root privilege such as grabbing packets or sending ARP request packets in the prior art, the ARP spoofing detection method in non-Root environment can be implemented based on the parsing of ARP cache table, which extends the application scenario of ARP spoofingdetection.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an ARP deception detection method, device and terminal in a non-Root environment. Background technique [0002] ARP is a TCP (Transmission Control Protocol) / IP protocol for obtaining a MAC (Media Access Control, Media Access Control) address based on an IP (Internet Protocol, Internet Protocol) address. [0003] Since ARP is based on the mutual trust of each device in the LAN, after the terminal receives the ARP response, it will not check the authenticity of the ARP response, but will directly associate the source IP address and the source MAC address in the ARP response. Stored in the ARP cache table in the memory, this gives the conditions for ARP spoofing to occur. [0004] After receiving the ARP request broadcast, the hacker forges the ARP response packet and sends it to the attacked host, or the hacker continuously sends the forged ARP response packet to all the ...

AI Technical Summary

Problems solved by technology

When the host communicates with an IP host in the LAN, the information is not sent to the IP host but to the fake MAC host, which leads to ARP spoofing

[0005] In order to reduce the occurrence of ARP spoofing, existing technologies provide a large number of ways to use packet capture or release ARP request packets for ARP spoofing detection, but most of these existing technologies need to run at the data link layer, and must obtain Root permission It is used under non-Root authority, and does not provide a better ARP spoofing detection scheme

Images