shARP: detect and remove any ARP-spoofer detect and remove any ARP-spoofer from the network
shARP
ARP spoofing allows an attacker to intercept data frames on a network, modify the traffic, or stop all traffic. Often the attack is used as an opening for other attacks, such as denial of service, man in the middle, or session hijacking attacks. This anti-ARP spoofing program, (shARP) detects the presence of a third party in a private network actively. It has 2 modes: defensive and offensive.
Defensive mode protects the end user from the spoofer by disconnecting the user’s system from the network. This mode also alerts the user by an audio message as soon as spoofing is detected. 
Offensive mode disconnects the user’s system from the network and further kicks out the attacker by sending De-authentication packets to his system, this doesn’t let him reconnect to the network until the program is manually reset. 
Records
The program creates a log file (/usr/shARP/)containing the details of the attack such as the attackers’ mac address, mac vendor, time and date of the attack.
We can identify the NIC of the attackers’ system with the help of the obtained mac address. The whole program is designed especially for Linux and is written in Linux shell command (bash command). In the offensive mode, the program downloads an open-source application form with the permission of the user namely aircrack-ng (if not present in the user’s system already). Visit https://www.aircrack-ng.org for more info.
Edits-
If you wish to get an audio alert please download speak or comment out those lines in the source code.
Download
git clone https://github.com/europa502/shARP.git
How to use
bash ./shARP.sh -r [interface] to reset the network card and driver.
bash ./shARP.sh -d [interface] to activate the program in defense mode.
bash ./shARP.sh -o [interface] to activate the program in offense mode.
bash ./shARP.sh -h for help.
Note –
- I won’t suggest using this software over wired connections, especially in the offensive mode as it might cause network instability.
- Use the offensive mode only with the NICs that supports monitor mode.
- The offensive mode does DOS attack the ARP-spoofer. So use Offensive mode only after making sure that you have appropriate right over the network and the devices connected to it and make sure that doing so is legal in your Country/State.
