使用tcpdump查找ARP中毒机器

楼上网络不稳定，有可能是有的机器中了ARP欺骗／病毒。
可以使用tcpdump命令检查看是哪台机器有可能中毒：
tcpdump -nn -i eth0 arp
如果出现如下信息，则说明可能是210.77.68.244感染了arp病毒。

22:42:57.790341 arp who-has 210.77.68.124 tell 210.77.68.244
22:42:57.790348 arp who-has 210.77.68.124 tell 210.77.68.244
22:42:57.813105 arp who-has 210.77.68.135 tell 210.77.68.254
22:42:57.822898 arp who-has 210.77.68.125 tell 210.77.68.244
22:42:57.822906 arp who-has 210.77.68.125 tell 210.77.68.244
22:42:57.852916 arp who-has 210.77.68.126 tell 210.77.68.244
22:42:57.852923 arp who-has 210.77.68.126 tell 210.77.68.244
22:42:57.863858 arp who-has 210.77.68.251 tell 210.77.68.254
22:42:57.885405 arp who-has 210.77.68.127 tell 210.77.68.244
22:42:57.885412 arp who-has 210.77.68.127 tell 210.77.68.244
22:42:57.915324 arp who-has 210.77.68.128 tell 210.77.68.244
22:42:57.915331 arp who-has 210.77.68.128 tell 210.77.68.244