第10天：MAC地址和ARP协议

# Windows
arp -a

# Linux/Mac
arp -n

# 查看特定IP的MAC
arp -n 192.168.1.1

# 清空ARP缓存（需要管理员权限）
# Windows
arp -d

# Linux
sudo ip -s -s neigh flush all

# Mac
sudo arp -d -a

# day10_arp_scanner.py
# 功能：ARP扫描工具

import socket
import struct
import time
from concurrent.futures import ThreadPoolExecutor

class ARPScanner:
    """ARP扫描器"""

    def __init__(self):
        # OUI数据库（部分常见厂商）
        self.oui_database = {
            '00:50:56': 'VMware',
            '00:0C:29': 'VMware',
            '00:1C:42': 'Parallels',
            '08:00:27': 'VirtualBox',
            'DC:A6:32': 'Raspberry Pi',
            '3C:A9:F4': '小米',
            '28:6C:07': '小米',
            'F8:A4:5F': '华为',
            '00:E0:4C': '华为',
            'AC:DE:48': 'Apple',
            '00:03:93': 'Apple',
        }

    def get_mac_vendor(self, mac):
        """
        根据MAC地址获取厂商信息

        参数：
            mac: MAC地址字符串

        返回：
            厂商名称
        """
        # 提取OUI（前3个字节）
        oui = ':'.join(mac.split(':')[:3]).upper()

        return self.oui_database.get(oui, '未知厂商')

    def get_local_ip(self):
        """
        获取本机IP地址
        """
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
            sock.connect(("8.8.8.8", 80))
            local_ip = sock.getsockname()[0]
            sock.close()
            return local_ip
        except:
            return None

    def get_mac_address(self, ip):
        """
        通过ARP获取指定IP的MAC地址

        参数：
            ip: 目标IP地址

        返回：
            MAC地址字符串，如果失败返回None

        工作原理：
            发送ARP请求，等待响应
        """
        try:
            # 在Windows上使用arp命令
            import subprocess
            import platform

            system = platform.system()

            if system == 'Windows':
                # Windows: arp -a IP
                result = subprocess.check_output(
                    f'arp -a {ip}',
                    shell=True,
                    stderr=subprocess.DEVNULL
                ).decode('gbk', errors='ignore')

                # 解析输出
                for line in result.split('\n'):
                    if ip in line:
                        parts = line.split()
                        if len(parts) >= 2:
                            mac = parts[1].replace('-', ':')
                            return mac

            else:
                # Linux/Mac: arp -n IP
                result = subprocess.check_output(
                    f'arp -n {ip}',
                    shell=True,
                    stderr=subprocess.DEVNULL
                ).decode('utf-8', errors='ignore')

                for line in result.split('\n'):
                    if ip in line:
                        parts = line.split()
                        if len(parts) >= 3:
                            return parts[2]

        except:
            pass

        return None

    def ping_and_get_mac(self, ip):
        """
        先ping一下IP（触发ARP），然后获取MAC地址

        参数：
            ip: 目标IP地址

        返回：
            (ip, mac, vendor) 元组，失败返回None
        """
        try:
            import subprocess
            import platform

            system = platform.system()

            # 先ping一下，触发ARP
            if system == 'Windows':
                ping_cmd = f'ping -n 1 -w 500 {ip}'
            else:
                ping_cmd = f'ping -c 1 -W 1 {ip}'

            subprocess.run(
                ping_cmd,
                shell=True,
                stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL,
                timeout=2
            )

            # 获取MAC地址
            mac = self.get_mac_address(ip)

            if mac and mac != '(incomplete)' and 'ff:ff:ff:ff:ff:ff' not in mac.lower():
                vendor = self.get_mac_vendor(mac)
                return (ip, mac, vendor)

        except:
            pass

        return None

    def scan_network(self, network, max_workers=50):
        """
        扫描整个网络

        参数：
            network: 网络地址（如 "192.168.1.0/24"）
            max_workers: 最大线程数

        返回：
            发现的设备列表
        """
        import ipaddress

        print(f"🔍 开始扫描网络: {network}")
        print(f"⏳ 请稍候...\n")

        # 解析网络
        net = ipaddress.ip_network(network, strict=False)
        total = net.num_addresses - 2

        devices = []
        scanned = 0

        # 使用线程池并发扫描
        with ThreadPoolExecutor(max_workers=max_workers) as executor:
            futures = {
                executor.submit(self.ping_and_get_mac, str(ip)): ip
                for ip in net.hosts()
            }

            from concurrent.futures import as_completed

            for future in as_completed(futures):
                scanned += 1
                result = future.result()

                if result:
                    devices.append(result)
                    ip, mac, vendor = result
                    print(f"✅ {ip:<15} {mac:<17} {vendor}")

                # 显示进度
                if scanned % 20 == 0:
                    progress = (scanned / total) * 100
                    print(f"   进度: {progress:.1f}% ({scanned}/{total})", end='\r')

        return devices

    def display_results(self, devices):
        """
        显示扫描结果

        参数：
            devices: 设备列表
        """
        print("\n" + "=" * 70)
        print(f"扫描完成！共发现 {len(devices)} 台设备")
        print("=" * 70)

        if devices:
            print(f"\n{'IP地址':<15} {'MAC地址':<17} {'厂商'}")
            print("-" * 70)

            for ip, mac, vendor in sorted(devices):
                print(f"{ip:<15} {mac:<17} {vendor}")

        print("\n" + "=" * 70)

def view_arp_cache():
    """
    查看系统ARP缓存
    """
    import subprocess
    import platform

    print("=" * 70)
    print("系统ARP缓存表".center(70))
    print("=" * 70)
    print()

    try:
        system = platform.system()

        if system == 'Windows':
            result = subprocess.check_output('arp -a', shell=True).decode('gbk', errors='ignore')
        else:
            result = subprocess.check_output('arp -n', shell=True).decode('utf-8', errors='ignore')

        print(result)

    except Exception as e:
        print(f"❌ 无法获取ARP缓存: {e}")

    print("=" * 70)

def main():
    """
    主函数
    """
    scanner = ARPScanner()

    print("=" * 70)
    print("ARP扫描工具".center(70))
    print("=" * 70)
    print()

    # 获取本机IP
    local_ip = scanner.get_local_ip()
    if local_ip:
        print(f"💻 本机IP: {local_ip}")

        # 推断网络
        ip_parts = local_ip.split('.')
        network = f"{ip_parts[0]}.{ip_parts[1]}.{ip_parts[2]}.0/24"
        print(f"🌐 推断网络: {network}")
    else:
        network = "192.168.1.0/24"
        print(f"🌐 使用默认网络: {network}")

    print()
    print("请选择功能:")
    print("1. 扫描局域网设备（推荐）")
    print("2. 扫描自定义网络")
    print("3. 查看ARP缓存表")
    print("0. 退出")

    choice = input("\n请输入选项: ").strip()

    if choice == '1':
        devices = scanner.scan_network(network)
        scanner.display_results(devices)

    elif choice == '2':
        custom_network = input("\n请输入网络地址（如192.168.1.0/24）: ").strip()
        if custom_network:
            devices = scanner.scan_network(custom_network)
            scanner.display_results(devices)

    elif choice == '3':
        view_arp_cache()

    elif choice == '0':
        print("\n再见！")

if __name__ == "__main__":
    main()

python code/day10/day10_arp_scanner.py

# 1. Ping触发ARP
subprocess.run(f'ping -c 1 {ip}', ...)

# 2. 系统自动发送ARP请求
# 3. 目标主机响应
# 4. 系统缓存ARP表项

# 5. 读取ARP缓存
subprocess.check_output('arp -n', ...)

# 使用线程池并发扫描多个IP
with ThreadPoolExecutor(max_workers=50) as executor:
    # 50个线程同时工作
    futures = {executor.submit(ping_and_get_mac, ip): ip
               for ip in net.hosts()}

# 通过MAC地址前3个字节（OUI）识别厂商
oui = mac[:8]  # 如 "00:50:56"
vendor = oui_database.get(oui, '未知厂商')