ARP sniffer
May 01, 20171 min read

#!/usr/bin/env python
from scapy.all import *
def arp_monitor_callback(pkt):
if ARP in pkt:
pkt[ARP].remove_payload()
return pkt[ARP].summary()
if pkt[ARP].op == 2: # Is at
return pkt.sprintf("%ARP.psrc% is at %ARP.hwsrc% => %ARP.pdst%")
elif pkt[ARP].op == 1: # who has
return pkt.sprintf("Who has %ARP.pdst% tell %ARP.psrc%")
sniff(prn=arp_monitor_callback, filter="arp", store=0)