基于SNMP与WinPcap的ARP攻击实时检测与恢复  

Real-time Detection and Recovery of ARP Attack Based on SNMP and WinPcap

作　　者：王力[1] 李禹生[1] 胡乐炜[1] 

机构地区：[1]武汉工业学院数理与计算机学院,武汉430023

出　　处：《科技通报》2012年第6期78-79,共2页Bulletin of Science and Technology

基　　金：2006年度湖北省教育厅科研项目(D200618003)

摘　　要：ARP攻击难以检测和定位,会造成网络瘫痪,甚至从中窃取用户的私密信息,给网络管理带来很大的困难和负担。针对ARP协议的缺陷,通过ARP攻击模拟实验总结出ARP映射表的更新规律,分析ARP攻击常见的防御办法,最后结合SNMP和WinPcap两种技术,提出一种对ARP攻击进行实时检测与恢复的方法。ARP attack is difficult to be detected and located,which could paralyze the whole network and even cause user＇s private information to be stolen,bringing enormous difficulties and burdens to the management of network.As for the flaws of the ARP protocol,the updating mechanism of the ARP mapping table is summarized by ARP attacking simulation experiments.The approaches of the usual methods for defending are analyzed in detail.An effective method which could real-time detect and recover the ARP attack is designed by combining SNMP and WinPcap.

关 键 词：ARP攻击 WINPCAP SNMP 实时检测与恢复 

分 类 号：TP319[自动化与计算机技术—计算机软件与理论]