基于WinPcap和ARP欺骗实现交换环境嗅探  

Packet sniffing in switched ethernet by WinPcap and ARP spoofing

作　　者：孙海峰[1] 宋丽丽[1] 

机构地区：[1]西南科技大学计算机科学与技术学院,四川绵阳621010

出　　处：《计算机工程与设计》2007年第10期2326-2328,共3页Computer Engineering and Design

基　　金：西南科技大学基金项目(06zx3154)

摘　　要：传统的数据嗅探方法不能在交换式局域网环境下实现。在分析了局域网的共享环境和交换环境各自特点后,基于地址解析协议ARP的工作原理,提出一种利用ARP欺骗实现中间人攻击,从而实现交换环境数据嗅探的方法。利用WinPcap驱动实现的嗅探软件降低了对操作系统版本的依赖程度,整个过程包括了ARP欺骗和欺骗后的恢复,以及数据嗅探和数据转发功能。实验表明利用ARP欺骗所实现的数据嗅探完全能够在交换式的局域网中工作,并且不会中断被攻击主机之间的正常通信。Traditional methods of packet sniffing can＇t be realized in switched ethernet. After differences between shared and switched Ethernet environment is introduced, based on the principle of ARP, a kind ofman-in-the-middle-attacks method in switched Ethernet is brought forward by ARP spoofmg, and packet sniffing is realized. The sniffer realized by WinPcap driver, which decreases the dependency of OS, and the whole progress includes ARP spoofing, recovery after ARP spoofing, packets Sniffing and forward. The experiment proves packet sniffering realized by ARP spoofing can work completely in switched Ethernet, and communications between targets won＇t be broken.

关 键 词：ARP欺骗 交换环境 中间人攻击 WinPcap驱动 数据嗅探 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]