ARP test mode. According to the idea we design the arithmetic for the key part, first the system sends a message to the target machine, and then system wait for the response. Once system receives a message, it starts to analyze the message, according to the message s parameter system judges whether the message satisfies the conditions. Once the message satisfies all the conditions, the system thinks the machine is sniffing, and adds this machine into the list of sniffing machines. On this basis the detection has done well, and at the same time we insert the result into the log database for inquire and analyze later.
