BAT batch processing solves ARP attacks

Nowadays, there are many cases of ARP Virus Infection in Lan, which make it difficult to clean up and prevent it, causing a lot of troubles for many network administrators. The following is my personal experience in solving this problem, and I have also read a lot of references online.ARP virus symptomsSometimes the Internet cannot be accessed normally, and sometimes there is good, including access to the network neighbors, the copy of files cannot be completed, and an error occurs; ARP packets in the LAN burst, when ARP is used for query, an abnormal MAC address or an incorrect MAC address is found, and a MAC address corresponds to multiple IP addresses.Principles of ARP attacksPackets of ARP spoofing attacks generally have the following two features: one of them can be regarded as an attack packet alarm: the source address, target address, and Protocol address of the first Ethernet data packet header do not match. Alternatively, the ARP packet Sending address and target address are not in the MAC database of the network adapter, or do not match the MAC/IP address of the MAC database of the network. All of these will trigger an alarm immediately. Check the source address (which may also be forged) of these data packets (Ethernet data packets) to find out that the machine is launching an attack. Now there are network management tools, such as network law enforcement officers and P2P Terminators, which will also pretend to be gateways in the same way, deceiving clients to access the gateway, that is, they will obtain the traffic sent to the gateway, in this way, network traffic management, network monitoring, and other functions can bring potential harm to network management, that is, it can easily obtain user password and other related information.Solution:Write a script for your reference to solve the Local Area Network's APR attack c: cd \ if exist ipconfig.txt del ipconfig.txt ipconfig/all> c: \ ipconfig.txt // obtain the local MAC address if exist GateMac.txt del GateMac.txt arp-a % GateIP %> c: \ GateMac.txt for/f "skip = 3 tokens = 2" % H in(GateMac.txt) do set ingress MAc = % H // obtain the MAc address of the egress route (that is, the Gateway) if exist route ip.txt del route ip.txt find "Default Gateway" ipconfig.txt> c: \ GateIP.txt for/f "skip = 2 tokens = 13" % G in (GateIP.txt) do set multicast IP = % G echo set Ws = Wscript. createobject ("Wscript. shell ")> c: \ banding. vbs echo count = 0> banding. vbs echo for each ps in getobject ("winmgmts :\\. \ root \ cimv2: win32_process "). instances _> banding. vbs re-binds the IP address of the gateway to the MAC address at 6 seconds. echo if ps. name = "wscript.exe" then count = count + 1> banding. vbs echo if count> 2 then wscript. quit> banding. vbs echo I = 1> banding. vbs echo for I = 1 to 5> banding. vbs echo I = I-1> banding. vbs echo Wscript. sleep (1000*60*0.1) is bound once every 6 seconds> banding. vbs echo ws. run "arp-d", 0> banding. vbs echo ws. run "arp-s % GateIP % GateMac %", 0> banding. vbs echo next> banding. vbs clears the ARP cache and rebinds the local IP address to the MAC address c: cd \ start banding. vbs del/f/q GateMac.txt del/f/q ipconfig.txt del/f/q GateIP.txt copy banding. vbs c: \ windows \ system32 echo Windows Registry Editor Version 5.00> c: \ arp. reg echo.> arp. reg echo [HKEY_LOC AL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run]> arp. reg echo "arptom" = "c: \ windows \ system32 \ banding. vbs "> arp. reg regedit-is arp. reg del/f/q arp. reg del/f/q banding. vbs exit copies the code into the notepad and saves the suffix. bat is suitable for various environments