🛡️ Advanced ARP Spoof Detector & Network MAC Scanner

A powerful Python-based ARP Spoof Detection, Network Scanner, and MAC Address Finder built with Scapy.

---

📌 Overview

Advanced ARP Spoof Detector is a cybersecurity tool that continuously monitors ARP traffic to detect ARP Spoofing (MITM) attacks in real time.

Unlike basic ARP detectors, this project also includes:

• Live Network Scanner
• MAC Address Finder
• Vendor Detection (OUI Lookup)
• CSV & JSON Export
• Whitelist Support
• Duplicate MAC Detection
• Alert Logging
• Session Statistics

This project is intended for educational purposes, network monitoring, and cybersecurity research.

---

Features

ARP Spoof Detection

• Real-time ARP packet monitoring
• Detects MAC Address changes
• Multi-packet confirmation before alerting
• Alert cooldown system
• False positive reduction

---

Network Scanner

• Scan entire local subnet
• Discover all live devices
• Collect IP Address
• Collect MAC Address
• Vendor Identification
• Response Time

---

MAC Finder

• Show your own MAC Address
• Find MAC of any IP
• Find MAC from monitoring table
• Export discovered MAC addresses

---

Vendor Detection

Identifies device manufacturers using MAC OUI.

Examples:

• Cisco
• Intel
• Dell
• Lenovo
• Huawei
• Samsung
• TP-Link
• Netgear
• VMware
• VirtualBox
• Raspberry Pi
• ESP32
• Arduino
• ASUS
• Realtek

---

Export Options

Export discovered devices to:

• CSV
• JSON

Useful for:

• Incident reports
• Network documentation
• Digital forensics

---

Session Summary

Displays:

• Interface used
• Total packets monitored
• Total spoof alerts
• Normal devices
• Spoofed devices
• Session duration

---

Project Structure

Advanced-ARP-Spoof-Detector
│
├── detector.py
├── alerts.txt
├── arp_log.csv
├── arp_log.json
├── requirements.txt
├── README.md
└── screenshots/

---

Installation

Clone the repository

git clone https://github.com/atharvs13/Advanced-ARP-Spoof-Detector.git
cd Advanced-ARP-Spoof-Detector

Install dependencies

pip install -r requirements.txt

Run

Linux

sudo python detector.py

Windows

python detector.py

---

Requirements

Python 3.9+

Libraries:

• Scapy
• Colorama
• PrettyTable

Install

pip install scapy colorama prettytable

---

Startup Modes

1. Start ARP Monitoring

2. MAC Finder

3. Quick Network Scan + Monitoring

0. Exit

---

Example Output

[✓] Auto Detected Interface

[✓] Your MAC Address

Scanning Network...

192.168.1.1
MAC: XX:XX:XX:XX:XX:XX
Vendor: Cisco

Monitoring Started...

---

Screenshots

Add screenshots inside

screenshots/

Example:

• Startup Menu
• Network Scan
• Spoof Detection
• Session Summary

---

How Detection Works

ARP Reply
      │
      ▼
Extract IP + MAC
      │
      ▼
Compare With Stored Table
      │
      ├───────────────┐
      │               │
      ▼               ▼
Same MAC         Different MAC
      │               │
      ▼               ▼
Update Table   Verify Multiple Times
                     │
                     ▼
             Confirm Spoof
                     │
                     ▼
           Log + Alert + Export

---

Future Improvements

• Email Alerts
• Telegram Alerts
• Discord Webhook
• GUI Dashboard
• Flask Web Interface
• SQLite Database
• Multi-threading
• PCAP Recording
• AI-Based Anomaly Detection

---

Disclaimer

This project is developed for educational purposes, security research, and authorized network monitoring only.

Do not use it against networks without permission.

---

Credits

Original Repository

https://github.com/prachi-cyber-tank/Advanced-ARP-Spoof-Detector

Improved Version

Developed and enhanced by

Atharvs13

GitHub

https://github.com/atharvs13

---

License

MIT License