Skip to content

Instantly share code, notes, and snippets.

@joncutrer
Last active July 21, 2020 00:08
Show Gist options
  • Save joncutrer/5d834e705f9ab4d2f9cc3fc6c4ed3c3d to your computer and use it in GitHub Desktop.
Save joncutrer/5d834e705f9ab4d2f9cc3fc6c4ed3c3d to your computer and use it in GitHub Desktop.
This script listens for ARP request packets using scapy to learn the IP and Mac Address of LAN hosts. Learn more about this script at https://jcutrer.com/python/scapy-arp-listener
#!/usr/bin/env python3
"""scapy-arp-listener.py
Listen for arp packets using scapy to learn the IP and Mac Address of LAN hosts
Copyright (C) 2018 Jonathan Cutrer
License Dual MIT, 0BSD
"""
from __future__ import print_function
from scapy.all import *
import time
__version__ = "0.0.1"
def handle_arp_packet(packet):
# Match ARP requests
if packet[ARP].op == ARP.who_has:
print('New ARP Request')
print(packet.summary())
#print(ls(packet))
print(packet[Ether].src, "has IP", packet[ARP].psrc)
# Match ARP replies
if packet[ARP].op == ARP.is_at:
print('New ARP Reply')
print(packet.summary())
#print(ls(packet))
return
if __name__ == "__main__":
sniff(filter="arp", prn=handle_arp_packet)
@franciscopaglia
Copy link

franciscopaglia commented Jul 21, 2020

Nice! Thank you! I had to make a small tweak and define the corresponding values for the OpCode field in the ARP packet:

who_has = 1;
is_at = 2;

# ...

if packet[ARP].op == who_has
if packet[ARP].op == is_at

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment