from scapy.all import * import logging as log import sqlite3 import signal import sys def signal_handler(sig, frame): sys.exit(0) signal.signal(signal.SIGINT, signal_handler) def arp_display(pkt): if pkt[ARP].op == 1: #who-has (request) return f"Request from: {pkt[ARP].hwsrc} ({pkt[ARP].psrc}) requesting MAC for {pkt[ARP].pdst}" #if pkt[ARP].op == 2: #is-at (response) lookup("mac.db", str(pkt[ARP].hwsrc)) add("mac.db",str(pkt[ARP].hwsrc),round(time.time())) return f"Code: {pkt[ARP].op} - Source {pkt[ARP].hwsrc} with address {pkt[ARP].psrc}" def init(database): s = sqlite3.connect(database) c = s.cursor() c.execute(''' CREATE TABLE if not exists mac_table( id INTEGER PRIMARY KEY AUTOINCREMENT, mac text NOT NULL, ts integer NOT NULL );''') s.commit() def lookup(database, mac): s = sqlite3.connect(database) c = s.cursor() print ("lookup") c.execute("SELECT ts FROM mac_table where mac = ? ORDER BY ts DESC LIMIT 1;", mac) r = c.fetchone() print (r) if r is not None: print ("last seen: ", round(time.time()) - r, " ms ago") def add(database,mac,time): s = sqlite3.connect(database) c = s.cursor() c.execute("INSERT INTO mac_table (mac, ts) VALUES (?,?)", (mac, time)) s.commit() init("mac.db") while True: sniff(prn=arp_display, filter="arp", store=0, iface='wlan0', count=1)