ARP Spoofing Detector

arp.sh

#!/bin/bash
#
# Version: 1.0
# Date: 24-07-2013
# Author: Alberto Alcolea ([email protected])
#

PRIORITY="local0.alert"

icon="/home/alberto/.icons/elementary/actions/48/process-stop.svg"

prev=''

arp | while read ip hwtype mac flag iface
do
	if [ ! $mac == 'HWaddress' ]
	then
		for a in $prev
		do
			if [ $(echo $a | cut -d'_' -f2) == $mac ]
			then
				ip2=$(echo $a | cut -d'_' -f1)
				# echo "MAC duplicada: $ip - $ip2 [$mac]" 
				logger -p $PRIORITY "MAC duplicada: $ip - $ip2 [$mac]" > /dev/null 2> /dev/null
				service network-manager stop
				notify-send 'Detectado envenenamiento de tablas ARP' "$ip  -  $ip2\n[$mac]" -i $icon -u critical
			fi
		done
		prev="$prev $ip"_"$mac"
	fi
done