局域网中了ARP病毒不断遭到攻击怎么查出是哪个机器中的病毒？ 局域网如何查询哪台机器中arp病毒？？ 华为3026E
\u5355\u4f4d\u5c40\u57df\u7f51\u4e2d\u4e86ARP\u75c5\u6bd2\uff0c\u5171\u51e0\u767e\u53f0\u673a\u5668\uff0c\u600e\u4e48\u67e5\u51fa\uff0c\u600e\u4e48\u6740\u6389\u3010\u89e3\u51b3\u65b9\u6cd5\u3011
\u60a8\u597d\uff01\u901a\u5e38\u5bf9\u5f85\u5c40\u57df\u7f51\u4e2d\u7684ARP\u75c5\u6bd2\u5904\u7406\u65b9\u6cd5\uff1a
1.\u68c0\u6d4b\u786e\u8ba4\u662f\u5426\u4e2d\u4e86ARP\u75c5\u6bd2\u3002ARP\u75c5\u6bd2\u7684\u75c7\u72b6\uff1a\u4e0a\u7f51\u65f6\u597d\u65f6\u65ad\uff0c\u8bbf\u95ee\u7f51\u4e0a\u90bb\u5c45\u4e5f\u662f\u5982\u6b64\uff0c\u62f7\u8d1d\u6587\u4ef6\u65e0\u6cd5\u5b8c\u6210\uff0c\u51fa\u73b0\u9519\u8bef\uff1b\u5c40\u57df\u7f51\u5185\u7684ARP\u5305\u7206\u589e\uff0c\u4f7f\u7528ARP\u67e5\u8be2\u7684\u65f6\u5019\u4f1a\u53d1\u73b0\u4e0d\u6b63\u5e38\u7684MAC\u5730\u5740\uff0c\u6216\u8005\u662f\u9519\u8bef\u7684MAC\u5730\u5740\u5bf9\u5e94\uff0c\u8fd8\u6709\u5c31\u662f\u4e00\u4e2aMAC\u5730\u5740\u5bf9\u5e94\u591a\u4e2aIP\u7684\u60c5\u51b5\u4e5f\u4f1a\u6709\u51fa\u73b0\u3002
2.\u6e05\u9664\u5c40\u57df\u7f51\u4e2d\u7684ARP\u75c5\u6bd2\u3002\u8bf7\u53c2\u8003\uff1ahttp://feiying.blog.51cto.com/230250/42812
3.\u9884\u9632\u63aa\u65bd
a\u3001\u53ca\u65f6\u5347\u7ea7\u5ba2\u6237\u7aef\u7684\u64cd\u4f5c\u7cfb\u7edf\u548c\u5e94\u7528\u7a0b\u5f0f\u8865\u4e01\uff1b
b\u3001\u5b89\u88c5\u548c\u66f4\u65b0\u6740\u6bd2\u8f6f\u4ef6\u3002
c\u3001\u5982\u679c\u7f51\u7edc\u89c4\u6a21\u8f83\u5c11\uff0c\u5c3d\u91cf\u4f7f\u7528\u624b\u52a8\u6307\u5b9aIP\u8bbe\u7f6e\uff0c\u800c\u4e0d\u662f\u4f7f\u7528DHCP\u6765\u5206\u914dIP\u5730\u5740\u3002
d\u3001\u5982\u679c\u4ea4\u6362\u673a\u652f\u6301\uff0c\u5728\u4ea4\u6362\u673a\u4e0a\u7ed1\u5b9aMAC\u5730\u5740\u4e0eIP\u5730\u5740\uff08\u4e0d\u662f\u597d\u529e\u6cd5\uff09
\u5c40\u57df\u7f51\u53d7ARP\u53d8\u79cd\u75c5\u6bd2\u653b\u51fb\u540e\u77ac\u95f4\u6389\u7ebf\u7684\u89e3\u51b3\u65b9\u6cd5 \u524d\u8a00\uff1a2006\u5e74\u7b97\u662fARP\u548cLOGO1\u75c5\u6bd2\u5bf9\u5c40\u57df\u7f51\u7684\u5371\u5bb3\u6700\u5927\uff0c\u5728\u524d\u671f\u6211\u4eec\u4e00\u822c\u91c7\u7528\u53cc\u5411\u6886\u5b9a\u7684\u65b9\u6cd5\u5373\u53ef\u89e3\u51b3 \u4f46\u662fARP\u53d8\u79cd \u51fa\u73b0\u65e5\u671f\u5927\u6982\u572810\u6708\u4efd\u5e95\uff0c\u5927\u5bb6\u4e5f\u8bb8\u8fd8\u5728\u4e3a\u7f51\u5173\u6389\u7ebf\u8fd8\u4ee5\u4e3a\u662f\u7535\u4fe1\u7684\u95ee\u9898\u8fd8\u70e6\u607c\u5427\uff0c\u5176\u5b9e\u4e0d\u7136\u53d8\u79cd\u8fc7\u7a0bARP\u75c5\u6bd2-\u53d8\u79cdOK\u75c5\u6bd2-\u53d8\u79cdTrojanDropper.Win32.Juntador.f\u6216TrojanDropper.Win32.Juntador.C \u73b0\u5728\u7684\u8fd9\u4e2aARP\u53d8\u79cd\u75c5\u6bd2\u66f4\u662f\u5389\u5bb3\uff0c\u6211\u628a\u81ea\u5df1\u9047\u5230\u8fc7\u7684\u60c5\u51b5\u8bf4\u7ed9\u5927\u5bb6\u542c\u542c\uff0c\u5982\u679c\u5927\u5bb6\u6709\u8fd9\u4e9b\u60c5\u51b5\uff0c\u4e0d\u597d\u610f\u601d\u201c\u606d\u559c\u4f60\u201d \u4f60\u4e2d\u5927\u5956\u4e86\uff0c\u5475\u5475~~ \u5148\u4e86\u89e3ARP\u53d8\u79cd\u75c5\u6bd2\u7684\u7279\u6027\u5427: \u4e00:\u7834\u574f\u4f60\u7684ARP\u53cc\u5411\u7ed1\u5b9a\u6279\u51fa\u7406 \u4e8c:\u4e2d\u6bd2\u673a\u5668\u6539\u53d8\u6210\u4ee3\u7406\u670d\u52a1\u5668\u53c8\u53eb\u4ee3\u7406\u8def\u7531 \u4e09:\u6539\u53d8\u8def\u7531\u7684\u7f51\u5173MAC\u5730\u5740\u548cinternat\u7f51\u5173\u7684MAC\u5730\u5740\u4e00\u6837 \u75c5\u6bd2\u53d1\u4f5c\u60c5\u51b5\uff1a\u73b0\u5728\u7684ARP\u53d8\u79cd \u4e0d\u662f\u653b\u51fb\u5ba2\u6237\u673a\u7684MAC\u5730\u5740\u653b\u51fb\u8def\u7531\u5185\u7f51\u7f51\u5173\uff0c\u6539\u53d8\u4e86\u5b83\u7684\u539f\u7406\uff0c\u8fd9\u70b9\u5b9e\u5728\u4f69\u670d \u76f4\u63a5\u653b\u51fb\u60a8\u7684\u8def\u7531\u7684\u4ec0\u4e48\u5730\u5740\u4f60\u77e5\u9053\u5417\uff1f\u54c8\u54c8~~\u731c\u731c\u5427~~\u4e0d\u5356\u5173\u4e86~~\u65b0\u7684\u53d8\u79cdARP\u76f4\u63a5\u653b\u51fb\u60a8\u8def\u7531\u7684MAC\u5730\u5740\u548c\u5916\u7f51\u7f51\u5173 \u800c\u4e14\u76f4\u63a5\u5c31\u628a\u7ed1\u5b9aIP\u4e0eMAC\u7684\u6279\u5904\u7406\u6587\u4ef6\u7981\u7528\u4e86\u3002\u4e00\u4f1a\u513f\u5168\u6389\u7ebf\uff0c\u4e00\u4f1a\u513f\u662f\u51e0\u53f0\u51e0\u53f0\u7684\u6389\u7ebf\u3002\u800c\u4e14 \u4e2d\u4e86ARP\u7684\u7535\u8111\u4f1a\u628a\u90a3\u53f0\u7535\u8111\u8f6c\u53d8\u6210\u5185\u7f51\u7684\u4ee3\u7406\u670d\u52a1\u5668\u8fdb\u884c\u76d7\u53f7\u548c\u53d1\u52a8\u653b\u51fb\u3002\u5982\u679c\u5927\u5bb6\u53d1\u73b0\u4e2d\u4e86ARP\u6ca1\u6709\u6389\u7ebf\uff0c\u90a3\u8bf4\u660e\u4f60 \u4e2d\u4e86\u6700\u65b0\u7684\u53d8\u79cd\uff0c\u4f60\u53ea\u8981\u91cd\u542f\u4e86\u90a3\u53f0\u4e2d\u4e86ARP\u75c5\u6bd2\u7684\u7535\u8111\uff0c\u90a3\u4e48\u53d7\u5230ARP\u653b\u51fb\u7684\u673a\u5b50\u5c31\u4f1a\u5168\u90e8\u6389\u7ebf \u5185\u7f51\u7684\u7f51\u5173\u4e0d\u6389\u5305\uff0c\u800c\u5916\u7f51\u7684IP\u548cDNS\u72c2\u6389\uff0c\u8fd9\u70b9\u4e5f\u662fARP\u53d8\u79cd\u7684\u51fa\u73b0\u7684\u60c5\u51b5\uff0c\u8bf7\u5927\u5bb6\u7559\u610f\u3002 \u6211\u5728\u6700\u540e\u4f1a\u516c\u5e03\u89e3\u51b3\u7684\u6848\u4f8b\u548c\u76f8\u5173\u8865\u4e01\uff0c\u8bf7\u5927\u5bb6\u770b\u5b8c\u5168\u6587\u53ef\u80fd\u5bf9\u4f60\u6709\u5e2e\u52a9\u54e6\uff0c\u4e0d\u8981\u6025\u7740\u4e0b~\u5475\u5475~ \u8be5\u75c5\u6bd2\u53d1\u4f5c\u65f6\u5019\u7684\u7279\u5f81\u4e3a\uff0c\u4e2d\u6bd2\u7684\u673a\u5668\u4f1a\u4f2a\u9020\u67d0\u53f0\u7535\u8111\u7684MAC\u5730\u5740\uff0c\u5982\u8be5\u4f2a\u9020\u5730\u5740\u4e3a\u7f51\u5173\u670d\u52a1\u5668\u7684\u5730\u5740\uff0c\u90a3\u4e48\u5bf9\u6574\u4e2a\u7f51\u5427\u5747\u4f1a\u9020\u6210\u5f71\u54cd\uff0c\u7528\u6237\u8868\u73b0\u4e3a\u4e0a\u7f51\u7ecf\u5e38\u77ac\u65ad\u3002 \u4e00\u3001\u5728\u4efb\u610f\u5ba2\u6237\u673a\u4e0a\u8fdb\u5165\u547d\u4ee4\u63d0\u793a\u7b26(\u6216MS-DOS\u65b9\u5f0f)\uff0c\u7528arp \u2013a\u547d\u4ee4\u67e5\u770b\uff1a C:\WINNT\system32>arp -a Interface: 192.168.0.193 on Interface 0x1000003 Internet Address Physical Address Type 192.168.0.1 00-50-da-8a-62-2c dynamic 192.168.0.23 00-11-2f-43-81-8b dynamic 192.168.0.24 00-50-da-8a-62-2c dynamic 192.168.0.25 00-05-5d-ff-a8-87 dynamic 192.168.0.200 00-50-ba-fa-59-fe dynamic \u53ef\u4ee5\u770b\u5230\u6709\u4e24\u4e2a\u673a\u5668\u7684MAC\u5730\u5740\u76f8\u540c\uff0c\u90a3\u4e48\u5b9e\u9645\u68c0\u67e5\u7ed3\u679c\u4e3a 00-50-da-8a-62-2c\u4e3a192.168.0.24\u7684MAC\u5730\u5740\uff0c192.168.0.1\u7684\u5b9e\u9645MAC\u5730\u5740\u4e3a00-02-ba-0b-04-32\uff0c\u6211\u4eec\u53ef\u4ee5\u5224\u5b9a192.168.0.24\u5b9e\u9645\u4e0a\u4e3a\u6709\u75c5\u6bd2\u7684\u673a\u5668\uff0c\u5b83\u4f2a\u9020\u4e86192.168.0.1\u7684MAC\u5730\u5740\u3002 \u4e8c\u3001\u5728192.168.0.24\u4e0a\u8fdb\u5165\u547d\u4ee4\u63d0\u793a\u7b26(\u6216MS-DOS\u65b9\u5f0f)\uff0c\u7528arp \u2013a\u547d\u4ee4\u67e5\u770b\uff1a C:\WINNT\system32>arp -a Interface: 192.168.0.24 on Interface 0x1000003 Internet Address Physical Address Type 192.168.0.1 00-02-ba-0b-04-32 dynamic 192.168.0.23 00-11-2f-43-81-8b dynamic 192.168.0.25 00-05-5d-ff-a8-87 dynamic 192.168.0.193 00-11-2f-b2-9d-17 dynamic 192.168.0.200 00-50-ba-fa-59-fe dynamic \u53ef\u4ee5\u770b\u5230\u5e26\u75c5\u6bd2\u7684\u673a\u5668\u4e0a\u663e\u793a\u7684MAC\u5730\u5740\u662f\u6b63\u786e\u7684\uff0c\u800c\u4e14\u8be5\u673a\u8fd0\u884c\u901f\u5ea6\u7f13\u6162\uff0c\u5e94\u8be5\u4e3a\u6240\u6709\u6d41\u91cf\u5728\u4e8c\u5c42\u901a\u8fc7\u8be5\u673a\u8fdb\u884c\u8f6c\u53d1\u800c\u5bfc\u81f4\uff0c\u8be5\u673a\u91cd\u542f\u540e\u7f51\u5427\u5185\u6240\u6709\u7535\u8111\u90fd\u4e0d\u80fd\u4e0a\u7f51\uff0c\u53ea\u6709\u7b49arp\u5237\u65b0MAC\u5730\u5740\u540e\u624d\u6b63\u5e38\uff0c\u4e00\u822c
1，比较简单的办法a,运行cmd
b,在命令行界面下，输入arp -a回车
c,先看你当前网关ip的mac数据，例如是10.16.0.1 MAC为 00-00-00-00-00-00(确认一下是不是你本身网关的mac，如果不是，那就可能受到arp攻击)，记下这个假的mac地址，然后，再在你刚才arp -a出来的数据里，找出和这个mac一样的ip地址，再去该机查看一下
2，运行抓包类软件，运行30秒左右，查看抓获的数据包里，ARP报文出现得最频繁的mac地址，如果有针对网内有做mac登记，那推算是哪一台相信很快就可以了
3,如果不怕麻烦，网内电脑都打限制arp发包功能的补丁,或者启用pppoe网络的用户登入方式，内部数据传输量大的某几个服务IP，可以指定小一点的子网，让它们走直通路由。
如果pc数量不多的话,可以直接用最笨的方法,逐个拔网线.
用360ARP防火墙，免费，方便~~网址 http://www.360.cn/down/soft_down11.html
绛旓細ARP鐨勬敾鍑诲ぇ澶氭槸浠庣粓绔笂鍙戣捣鐨勶紝鍥犳锛屽姣忓彴缁堢杩涜绠＄悊锛岄氳繃瀵圭綉鍗＄殑绠＄悊锛岀洿鎺ヤ粠缃戝崱涓婂緱鍒颁俊鎭紝鎶婂彂鍑虹殑鏁版嵁鍜岀綉鍗＄殑淇℃伅鍋氬姣旓紝鍙涓嶆槸鑷繁鐨勪俊鎭笉鍏佽鍏跺彂鍑猴紝杩欐牱灏辫兘寰堝ソ鐨勮繘琛屾帶鍒躲傝В鍐虫柟娉曪細1銆佹墍鏈夊鎴锋満闈欐佺粦瀹氱綉鍏筹紝缃戝叧璺敱鍣ㄧ粦瀹氭墍鏈夊鎴锋満鐨処P-MAC銆2銆佸湪灞鍩熺綉鍐呯殑鏌愬彴鐢佃剳涓...
绛旓細杩欎釜娑堟伅浠ｈ〃浜嗙敤鎴风殑MAC鍦板潃鍙戠敓浜嗗彉鍖,鍦ARP娆洪獥鏈ㄩ┈寮濮嬭繍琛岀殑鏃跺,灞鍩熺綉鎵鏈変富鏈虹殑MAC鍦板潃鏇存柊涓鐥呮瘨涓绘満鐨凪AC鍦板潃(鍗虫墍鏈変俊鎭殑MAC New鍦板潃閮戒竴鑷翠负鐥呮瘨涓绘満鐨凪AC鍦板潃),鍚屾椂鍦ㄨ矾鐢卞櫒鐨勨滅敤鎴风粺璁♀濅腑鐪嬪埌鎵鏈夌敤鎴风殑MAC鍦板潃淇℃伅閮戒竴鏍枫 濡傛灉鏄湪璺敱鍣ㄧ殑鈥滅郴缁熷巻鍙茶褰曗濅腑鐪嬪埌澶ч噺MAC Old鍦板潃閮戒竴鑷,鍒欒鏄庡眬鍩...
绛旓細棣栧厛浣犲紑鍚簡360灞鍩熺綉闅愯韩鍔熻兘涔堬紝鍦ㄨ缃噷鎶婃敼涓哄己鍔涢槻寰℃垨濮嬬粓鍚敤姣忕50.
绛旓細ARP鏀鍑绘槸浠庢暟鎹摼璺眰鍙戣捣鐨勶紝ARP涓嶆槸鐥呮瘨锛岃屾槸涓绉嶁滃崗璁ф敾鍑昏涓衡濓紝鐢变簬娌℃湁鏄庢樉鐨勭壒寰佸瓧浠ュ強ARP鍦ㄧ綉缁滈氳涓殑閲嶈鍦颁綅锛岄槻姣掑鍜岄槻鐏搴斿ARP鐥呮瘨涔熸潫鎵嬫棤绛栥傛墍浠ヤ粠婧愬ご涓鍫典綇闂鏁版嵁鐨勬祦鍑猴紝鍚屾椂鏀捐鍚堟硶鐨凙RP鏁版嵁鍖咃紝鎵嶆槸褰诲簳鎽嗚劚ARP鍥版壈鐨勭粓鏋佽В鍐虫柟妗堛傝繖鏄敱浜庝互澶綉鍗忚瀛樺湪婕忔礊閫犳垚鐨勶紝...
绛旓細2銆佷綘姣忓彴瀹㈡埛鏈洪兘浣滀簡鈥渁rp -s 缃戝叧ip 缃戝叧mac鈥濈殑闈欐佺粦瀹氾紱3銆佹煇鍙版満鍣ㄦ帀绾挎椂瀹冪殑arp琛ㄩ噷鐨勭綉鍏崇殑IP-MAC鏄纭殑锛岃岃矾鐢卞櫒閲屽搴旇瀹㈡埛鏈篒P鐨凪AC鍦板潃涓嶆纭傚熀浜庝互涓婁笁鐐瑰亣璁撅紝涓轰粈涔堟湁鐨勫鎴锋満杩樻槸浼氭帀绾垮憿锛熷鏋滀綘鐞嗚В浜咥RP鍗忚锛岃繖灏卞緢濂借В閲婁簡銆傛瘮濡備綘鏌愬彴瀹㈡埛鏈涓簡ARP娆洪獥鐥呮瘨锛岄偅涔堣...
绛旓細arp -d 鏂规硶鍥涳細灞鍩熺綉ARP鏀鍑诲厤鐤櫒,缃戜笂鏈夊緱涓嬨傦紙1锛夊皢杩欓噷闈3涓猟ll鏂囦欢澶嶅埗鍒皐indows\system32 閲岄潰锛屽皢npf 杩欎釜鏂囦欢澶嶅埗鍒 windows\system32\drivers 閲岄潰銆傦紙2锛夊皢杩4涓枃浠跺湪瀹夊叏灞炴閲鏀规垚鍙銆備篃灏辨槸涓嶅厑璁镐换浣曚汉淇敼銆傚洓銆佷互涓嬬▼搴忓甫鏈夋绫ARP鐥呮瘨锛堜紶濂囨潃鎵嬬瓑锛夛紝璇蜂笉瑕佷娇鐢細浼犲2鍐...
绛旓細姝ゆ椂鐥呮瘨鐭椂闂村仠姝㈠伐浣滐紝澶у浼氭劅鍒扮綉缁滄仮澶嶆甯搞傚姝ゅ弽澶嶏紝灏遍犳垚缃戠粶鏃舵柇鏃剁画銆傛儏鍐典簩銆灞鍩熺綉鍐呮湁鏌愪簺鐢ㄦ埛浣跨敤浜咥RP娆洪獥绋嬪簭锛堝锛氱綉缁滄墽娉曞畼銆佺綉缁滃壀鍒鎵嬨佷紶濂囨湪椹丵Q鐩楀彿杞欢绛夛級鍙戦丄RP娆洪獥鏁版嵁鍖咃紝鑷翠娇琚敾鍑荤殑鐢佃剳鍑虹幇绐佺劧涓嶈兘涓婄綉锛岃繃涓娈垫椂闂村張鑳戒笂缃戯紝鍙嶅鎺夌嚎鐨勭幇璞°備簩銆佹晠闅滆瘖鏂 濡傛灉鐢ㄦ埛...
绛旓細寮閫360鐨凙RP闃茬伀澧欍360ARP闃茬伀澧欓氳繃鍦ㄧ郴缁熷唴鏍稿眰鎷︽埅ARP鏀鍑绘暟鎹寘锛岀‘淇濈綉鍏虫纭殑MAC鍦板潃涓嶈绡℃敼锛屽彲浠ヤ繚闅滄暟鎹祦鍚戞纭紝浠庤屼繚璇侀氳鏁版嵁瀹夊叏鍜岀綉缁滅晠閫氥傚洓銆佸浣曟竻闄や腑姣掓満鍣ㄤ腑鐨凙RP鐥呮瘨锛 灞鍩熺綉涓锛屼互瀛︽牎鐨勬牎鍥綉涓轰緥锛屽綋鎮ㄧ殑鏈哄櫒涓簡ARP鐥呮瘨鍚庯紝浼氬悜鏈綉娈靛唴鐨勫叾浠栫數鑴戝彂閫侀敊璇殑璺敱鍣ㄥ湴鍧锛...
绛旓細鏌ョ湅arp浼氳瘽鏁版嵁锛屽涓嬪浘鎵绀猴細杩欓噷鎴戜滑鍙互鐪嬪埌鏀诲嚮婧愮殑IP鍦板潃MAC鍦板潃绛夛紝閫氳繃鎺掓煡璇AC/IP鏄綉鍐呭湴鍧杩樻槸缃戝鍦板潃杩涜闃绘柇鏀诲嚮锛屽鏋滄槸缃戝唴鍦板潃锛屽彧闇瑕佹妸璇ヤ富鏈烘壘鍑烘柇缃戞煡鏉鍗冲彲锛屽鏋滄槸缃戝鍦板潃锛屽垯鍙渶鍦ㄩ槻鐏涓璁剧疆鐩稿簲鐨勬嫤鎴瓥鐣ュ嵆鍙紝鎶婅MAC/IP鍦板潃鍙戦佺殑鍖呰繘琛屾嫤鎴氨鍙互浜 ...
绛旓細浣嗘槸ARP鏀鍑绘槸浠ュお缃戝崗璁厛婕忔礊浜х敓鐨勫簳灞傚崗璁敾鍑伙紝浠栦笉鍚屼簬鍗曟満鐥呮瘨浼氭湁绉嶇鐜拌薄渚涙垜浠煡鏉銆傚洜涓轰粬涓昏宸ヤ綔鍦ㄦ暟鎹摼璺眰鍜岀涓夊眰涔嬮棿锛岃屾潃姣掕蒋浠朵竴鑸伐浣滃湪搴旂敤灞傦紝鎵浠ユ牴鏈棤娉曟煡鏉瀹冧滑锛屽悜360鎻愪緵鐨勫彂鐜癆RP鏀诲嚮琚嫤鎴紝瀹冨彂鐜扮殑鏄敾鍑讳俊鎭紝鎷︽埅鐨勬槸鏀诲嚮淇℃伅锛屾槸涓轰簡鍛婅瘔浜轰滑浣犳垨鑰呮暣涓灞鍩熺綉琚獳RP鏀...
