Tiny Tool to Watch Out for ARP Poisoning

Recently I created a simple script for someone to watch out for malicious, or just any, ARP changes in their local cache.

The script just watches the ARP table and reports when modified. The script uses Python and BSD ARP tool. Do take note of the variations of Python version no., dependencies and ARP output.

from time import sleep
 import threading, subprocess
 
 arps = dict()
 
 class check(threading.Thread):
  def run(self):
  while True:
  arplines = subprocess.check_output(“arp -a | awk ‘{print $2 , $4}'”, shell=True).split(‘\n’)
  for line in arplines:
  if line.split():
  k=line.split()[0]
  v=line.split()[1]
  if k in arps and arps[k] != v:
  print “ALERT! MAC Address changed for ” + k arps[k] = v
  print arps sleep(5) return 0
 
 main = check()
 main.start()

Kristo Helasvuo, Guest Author.