Scapy Installation

To install Scapy it is necessary that you’ve Python 2.7 or Python 3.9+ version installed. If it is not installed then refer to this Python Installation. To prevent MITMs use Dynamic ARP Inspection, a security feature that will automatically reject malicious ARP packets that will be detected.

Linux

For a Linux user, it is possible to run scapy without libcap.

• Install tcpdump and make sure it is in $PATH 

$ sudo apt-get tcpdump

• The Kernel must have Packet sockets selected – CONFIG_PACKET
• If Kernel is less than 2.6 make sure Socket Filtering is selected – CONFIG_FILTER

Another Method to install Scapy on Linux is by installing Python on Linux Machine and then installing the Scapy Package inside Python Shell.

$ sudo apt-get install python3

After python is installed on the terminal open the python shell and execute the command to install scapy, then to use scapy for ARP Spoof Detection open Scapy to write your code in order to spoof and detect packets inside the network,

$ sudo apt-get install scapy (OR)
$ python -m install scapy
$ python
>> scapy

Debian/Fedora/Ubuntu

# Debian
$ sudo apt-get install tcpdump

# Fedora 
$ yum install tcpdmp

Then install Scapy via pip or apt. All dependencies may be installed either via a platform-specific installer or via PyPI

Windows

To install scapy on Windows it can be easily done through a command prompt, but for windows also Python should be pre-installed on the system. Then executing the commands to install scapy will be performed.

C:\> python -m install python-scapy
C:\> python
>> scapy

Now let’s start ARP Spoof Attack Detection using Scapy in Python

ARP Spoofing is also known as ARP Poisoning which is a type of cyberattack in which a malicious user sends falsified ARP (Address Resolution Protocol) messages over a LAN (Local Area Network). This results in the linking of an attacker’s MAC Address with the IP Address of a legitimate computer or server on the network.

Here we’ll perform passive monitoring or scanning to sniff the packets in the network after we receive one ARP Packet there are two things to be analyzed, on comparing them if they don’t match then the user is under ARP Spoof attack. In order to spoof and detect the ARP Packets inside the network use Scapy with Python to perform the detection of ARP Packets with the help of MAC Address and Interface.

• Source MAC Address
• Real MAC Address of the sender