Abstract:

In the switchbased LAN environment,the means of defending the ARP spoofing is maturing,leading to the sniffer based on the ARP spoofing is vulnerable to being intercepted and killed by security software,so it lacks sniffing effect. In this paper,one nonARP spoofing,which is called MAC spoofing,is proposed,and a LAN sniffer prototype based on the MAC spoofing is also designed and implemented. Compared with the  traditional ARP spoofing,the MAC spoofing can bypass a variety of ARP spoofing defense tools and succeed to intercept the network data,as well as carrying on the Denial of Service attacks. Through the use of a timealternate mechanism,a filtering mechanism and other key technologies,the efficiency and accuracy of the sniffer can be highly improved. The testing result shows that the sniffer may be better to break through the interception and killing of security software,and achieve the effect of sniffing.

Key words: ARP spoofing;MAC spoofing;switch environment;LAN;sniffer