使用批处理文件防备ARP攻击

@echo off::读取本机Mac地址if exist ipconfig.txt del ipconfig.txtipconfig /all >ipconfig.txtif exist phyaddr.txt del phyaddr.txtfind "Physical Address" ipconfig.txt >phyaddr.txtfor /f "skip=2 tokens=12" %%M in (phyaddr.txt) do set Mac=%%M::读取本机ip地址if exist IPAddr.txt del IPaddr.txtfind "IP Address" ipconfig.txt >IPAddr.txtfor /f "skip=2 tokens=15" %%I in (IPAddr.txt) do set IP=%%I::绑定本机IP地址和MAC地址arp -s %IP% %Mac%::读取网关地址if exist GateIP.txt del GateIP.txtfind "Default Gateway" ipconfig.txt >GateIP.txtfor /f "skip=2 tokens=13" %%G in (GateIP.txt) do set GateIP=%%G::读取网关Mac地址if exist GateMac.txt del GateMac.txtarp -a %GateIP% >GateMac.txtfor /f "skip=3 tokens=2" %%H in (GateMac.txt) do set GateMac=%%H::绑定网关Mac和IParp -s %GateIP% %GateMac%arp -s 网关IP 网关MACexit

@echo offfor /f "delims=: tokens=2" %%a in (ipconfig /all^ find "Physical Address") do set local_mac=%%afor /f "delims=: tokens=2" %%a in (ipconfig /all^ find "IP Address") do set local_ip=%%afor /f "delims=: tokens=2" %%a in (ipconfig /all^ find "Default Gateway") do set gate_ip=%%afo* /* %%* in (getmac /nh /s %local_ip%) do set gate_mac=%%aarp -s %local_ip% %local_mac%arp -s %gate_ip% %gate_mac% （这个地方有问题， 改进中……）

@ECHO OFFSETLOCAL ENABLEDELAYEDEXPANSIONfor /f "tokens=2 delims=[]=" %%i in (nbtstat -a %COMPUTERNAME%) do call set local=!local!%%ifor /f "tokens=3" %%i in (netstat -r^ find " 0.0.0.0") do set gm=%%ifor /f "tokens=1,2" %%i in (arp -a %gm%^ find /i /v "inter") do set gate=%%i %%jarp -s %gate%arp -s %local%arp -s 网关IP 网关MAC

@echo off:::::::::::::清除所有的ARP缓存arp -d:::::::::::::读取本地连接配置ipconfig /all>ipconfig.txt:::::::::::::读取内网网关的IPfor /f "tokens=13" %%I in (find "Default Gateway" ipconfig.txt) do set GatewayIP=%%I::::::::::::ING三次内网网关ping %GatewayIP% -n 3:::::::::::::读取与网关arp缓存arp -a find "%GatewayIP%">arp.txt:::::::::::::读取网关MAC并绑定for /f "tokens=1,2" %%I in (find "%GatewayIP%" arp.txt) do if %%I==%GatewayIP% arp -s %%I %%J:::::::::::::读取本机的 IP+MACfor /f "tokens=15" %%i in (find "IP Address" ipconfig.txt) do set ip=%%ifor /f "tokens=12" %%i in (find "Physical Address" ipconfig.txt) do set mac=%%i:::::::::::::绑定本机的 IP+MACarp -s %ip% %mac%:::::::::::::删除所有的临时文件del ipconfig.txtdel arp.txtexit