Toucan is currently a monitor to defend against man in the middle attacks (Both IPv4/IPv6 attacks) on a wireless network. For IPv4, when an attacker is discovered sending a gratuitous ARPs, Toucan will ‘un-poison’ the victim and the default gateway by sending out defensive ARPs with their original logged L2 addresses, and will then deauth the attacker off of the network and blacklist their L2 address. Additionally, toucan supports IPv6 spoofing defense by monitoring for gratuitous neighbor advertisements (since there is no ARP in IPv6).
Toucan is a Wireless Intrusion Detection System.
Dependencies:
+ Python 2.7.x
+ Pyshark Python Module
+ All Unix/Linux Support
Usage:
git clone https://github.com/collinsullivanhub/Toucan-IDS && cd Toucan-IDS sudo python toucan.py (run MUST ROOT)