OK

core/Function/ip_conflict_fun.py

@@ -0,0 +1,696 @@
+import concurrent.futures
+import csv
+import ipaddress
+import json
+import re
+import threading
+import time
+from dataclasses import asdict, dataclass, field
+from typing import Callable, Optional
+
+from core.Function.common import run_hidden
+from core.Function.loop_fun import normalize_mac
+from core.Function.network_fun import NetworkManager
+
+
+OutputCallback = Callable[[str, Optional[str]], None]
+DoneCallback = Callable[[], None]
+StatusCallback = Callable[[dict], None]
+ResultCallback = Callable[[dict], None]
+
+
+ALL_ADAPTERS = "全部活动网卡"
+MODE_BOTH = "两者都做"
+MODE_LOCAL = "本机 IP 检测"
+MODE_SUBNET = "网段扫描"
+
+
+@dataclass
+class IpConflictOptions:
+    mode: str = MODE_BOTH
+    scan_range: str = ""
+    workers: int = 64
+    timeout_ms: int = 500
+    max_hosts: int = 254
+    neighbor_samples: int = 3
+
+
+@dataclass
+class IpConflictEvidence:
+    address_state: str = ""
+    local_mac: str = ""
+    observed_macs: list[str] = field(default_factory=list)
+    conflict_macs: list[str] = field(default_factory=list)
+    tcpip_event_count: int = 0
+    gateway_mac_changes: int = 0
+    ip_mac_changes: int = 0
+    shared_mac_ips: int = 0
+    scanned_hosts: int = 0
+    notes: str = ""
+
+    def to_dict(self) -> dict:
+        data = asdict(self)
+        data["observed_macs"] = ", ".join(self.observed_macs)
+        data["conflict_macs"] = ", ".join(self.conflict_macs)
+        return data
+
+
+@dataclass
+class IpConflictResult:
+    adapter: str
+    ip: str
+    mac: str
+    conflict_macs: str
+    evidence_type: str
+    risk_level: str
+    verdict: str
+    evidence: IpConflictEvidence
+    checked_at: str = field(default_factory=lambda: time.strftime("%Y-%m-%d %H:%M:%S"))
+
+    def to_dict(self) -> dict:
+        data = {
+            "adapter": self.adapter,
+            "ip": self.ip,
+            "mac": self.mac,
+            "conflict_macs": self.conflict_macs,
+            "evidence_type": self.evidence_type,
+            "risk_level": self.risk_level,
+            "verdict": self.verdict,
+            "checked_at": self.checked_at,
+        }
+        data.update(self.evidence.to_dict())
+        return data
+
+
+class IpConflictDetector:
+    def __init__(
+        self,
+        output: OutputCallback,
+        done: Optional[DoneCallback] = None,
+        status: Optional[StatusCallback] = None,
+        result: Optional[ResultCallback] = None,
+    ):
+        self.output = output
+        self.done = done or (lambda: None)
+        self.status = status or (lambda _stats: None)
+        self.result = result or (lambda _row: None)
+        self.network = NetworkManager(lambda _text, _tag=None: None)
+        self.stop_event = threading.Event()
+        self.worker = None
+        self.last_results: list[dict] = []
+        self.last_summary = ""
+
+    def get_adapter_choices(self) -> list[str]:
+        adapters = self._active_adapters(self.network.get_network_info())
+        return [ALL_ADAPTERS] + [adapter["name"] for adapter in adapters]
+
+    def default_scan_range(self, adapter_name: str = ALL_ADAPTERS) -> str:
+        adapters = self._select_adapters(adapter_name)
+        if not adapters:
+            return ""
+        return adapter_to_safe_range(adapters[0])
+
+    def start_detection(self, adapter_name: str = ALL_ADAPTERS, options: Optional[dict] = None) -> None:
+        if self.is_running():
+            raise RuntimeError("IP 冲突检测正在运行，请先停止当前任务")
+
+        conflict_options = self.normalize_options(options)
+        adapters = self._select_adapters(adapter_name)
+        if not adapters:
+            raise ValueError("没有找到可检测的活动网卡")
+
+        self.stop_event.clear()
+        self.last_results = []
+        self.last_summary = ""
+        self.output(f"开始 IP 冲突检测: {adapter_name or ALL_ADAPTERS}，模式: {conflict_options.mode}\n", "muted")
+        self.output("说明: 检测结果基于本机可见 ARP/邻居表、地址状态和系统事件，不替代交换机侧排查。\n\n", "muted")
+        self.status(self._status("运行中", len(adapters), "", 0, 0, 0, 0))
+        self.worker = threading.Thread(target=self._run_detection, args=(adapters, conflict_options), daemon=True)
+        self.worker.start()
+
+    def _run_detection(self, adapters: list[dict], options: IpConflictOptions) -> None:
+        started = time.perf_counter()
+        completed = 0
+        max_risk = "正常"
+
+        try:
+            address_states = self.get_address_states()
+            events = self.get_tcpip_conflict_events()
+            neighbor_samples = [self.get_neighbors()]
+
+            if options.mode in (MODE_BOTH, MODE_SUBNET):
+                targets = self.build_scan_targets(adapters, options)
+                self.output(f"准备刷新 ARP: {len(targets)} 个地址，并发 {options.workers}，超时 {options.timeout_ms}ms\n", "muted")
+                self.status(self._status("扫描中", len(adapters), "", 0, len(targets), 0, time.perf_counter() - started))
+                self.refresh_arp_targets(targets, options)
+                neighbor_samples.append(self.get_neighbors())
+
+            for _index in range(max(options.neighbor_samples - len(neighbor_samples), 0)):
+                if self.stop_event.is_set():
+                    break
+                self.stop_event.wait(0.3)
+                neighbor_samples.append(self.get_neighbors())
+
+            rows = []
+            for adapter in adapters:
+                if self.stop_event.is_set():
+                    break
+                completed += 1
+                self.status(self._status("分析中", len(adapters), adapter["name"], 0, 0, completed, time.perf_counter() - started))
+                results = self.evaluate_adapter(adapter, address_states, events, neighbor_samples, options)
+                if not results:
+                    results = [normal_result(adapter, "未发现本机 IP 冲突证据")]
+                for item in results:
+                    row = item.to_dict()
+                    rows.append(row)
+                    self.last_results.append(row)
+                    max_risk = worse_risk(max_risk, item.risk_level)
+                    self.result(row)
+
+            self.last_summary = build_summary(rows, stopped=self.stop_event.is_set())
+            self.output("\nIP 冲突检测已停止\n" if self.stop_event.is_set() else "\nIP 冲突检测完成\n", "warning" if self.stop_event.is_set() else "success")
+            self.output(self.last_summary + "\n", "success" if max_risk == "正常" else "warning")
+            self.status(self._status("已停止" if self.stop_event.is_set() else "已完成", len(adapters), "", risk_rank(max_risk), 0, completed, time.perf_counter() - started))
+        except Exception as exc:
+            self.output(f"\nIP 冲突检测失败: {exc}\n", "error")
+            self.status(self._status("失败", len(adapters), "", 0, 0, completed, time.perf_counter() - started))
+        finally:
+            self.done()
+
+    def evaluate_adapter(
+        self,
+        adapter: dict,
+        address_states: dict,
+        events: list[dict],
+        neighbor_samples: list[list[dict]],
+        options: IpConflictOptions,
+    ) -> list[IpConflictResult]:
+        local_mac = normalize_mac(adapter.get("mac", ""))
+        local_ip = adapter.get("ipv4", "")
+        gateway = adapter.get("gateway", "")
+        interface_index = str(adapter.get("interface_index", ""))
+        local_neighbors = filter_neighbors(neighbor_samples, interface_index, local_ip)
+        ip_to_macs, mac_to_ips = build_neighbor_maps(local_neighbors)
+        results = []
+
+        state = address_states.get(local_ip, "")
+        event_hits = event_count_for_ip(events, local_ip)
+        observed_macs = sorted(ip_to_macs.get(local_ip, set()))
+        conflict_macs = sorted([mac for mac in observed_macs if local_mac and mac != local_mac and not is_special_mac(mac)])
+        if state in {"Duplicate", "Tentative", "DadFailed"} or event_hits or conflict_macs:
+            evidence = IpConflictEvidence(
+                address_state=state,
+                local_mac=local_mac,
+                observed_macs=observed_macs,
+                conflict_macs=conflict_macs,
+                tcpip_event_count=event_hits,
+                scanned_hosts=options.max_hosts,
+                notes="本机 IP 冲突证据",
+            )
+            level = "冲突风险"
+            reasons = []
+            if state:
+                reasons.append(f"地址状态 {state}")
+            if event_hits:
+                reasons.append(f"系统 Tcpip 冲突事件 {event_hits} 条")
+            if conflict_macs:
+                reasons.append("本机 IP 被其它 MAC 响应")
+            results.append(
+                IpConflictResult(
+                    adapter=adapter["name"],
+                    ip=local_ip,
+                    mac=local_mac,
+                    conflict_macs=", ".join(conflict_macs),
+                    evidence_type="本机 IP",
+                    risk_level=level,
+                    verdict="疑似本机 IP 冲突，请检查是否有其它设备使用相同地址。证据: " + "、".join(reasons),
+                    evidence=evidence,
+                )
+            )
+
+        multi_mac_ips = sorted(ip for ip, macs in ip_to_macs.items() if len([mac for mac in macs if not is_special_mac(mac)]) > 1)
+        for ip in multi_mac_ips:
+            if ip in {local_ip, gateway}:
+                continue
+            macs = sorted(ip_to_macs[ip])
+            evidence = IpConflictEvidence(
+                local_mac=local_mac,
+                observed_macs=macs,
+                conflict_macs=macs,
+                ip_mac_changes=1,
+                scanned_hosts=options.max_hosts,
+                notes="同一 IP 出现多个 MAC",
+            )
+            results.append(
+                IpConflictResult(
+                    adapter=adapter["name"],
+                    ip=ip,
+                    mac="",
+                    conflict_macs=", ".join(macs),
+                    evidence_type="网段 IP",
+                    risk_level="冲突风险",
+                    verdict="同一 IP 在邻居表中出现多个 MAC，疑似 IP 地址冲突。",
+                    evidence=evidence,
+                )
+            )
+
+        if gateway:
+            gateway_macs = sorted(ip_to_macs.get(gateway, set()))
+            if len([mac for mac in gateway_macs if not is_special_mac(mac)]) > 1:
+                evidence = IpConflictEvidence(
+                    local_mac=local_mac,
+                    observed_macs=gateway_macs,
+                    conflict_macs=gateway_macs,
+                    gateway_mac_changes=max(len(gateway_macs) - 1, 0),
+                    scanned_hosts=options.max_hosts,
+                    notes="网关 MAC 发生变化",
+                )
+                results.append(
+                    IpConflictResult(
+                        adapter=adapter["name"],
+                        ip=gateway,
+                        mac="",
+                        conflict_macs=", ".join(gateway_macs),
+                        evidence_type="网关",
+                        risk_level="可疑",
+                        verdict="网关 IP 对应多个 MAC，可能是网关冗余、ARP 欺骗或地址冲突，建议复核网关设备。",
+                        evidence=evidence,
+                    )
+                )
+
+        proxy_rows = []
+        for mac, ips in mac_to_ips.items():
+            clean_ips = [ip for ip in ips if not is_multicast_or_broadcast_ip(ip)]
+            if len(clean_ips) >= 8 and mac != local_mac:
+                proxy_rows.append((mac, sorted(clean_ips)))
+        for mac, ips in proxy_rows[:3]:
+            evidence = IpConflictEvidence(
+                local_mac=local_mac,
+                observed_macs=[mac],
+                shared_mac_ips=len(ips),
+                scanned_hosts=options.max_hosts,
+                notes="同一 MAC 对应大量 IP，可能是 Proxy ARP 或网关代理，不直接判定为 IP 冲突",
+            )
+            results.append(
+                IpConflictResult(
+                    adapter=adapter["name"],
+                    ip=", ".join(ips[:5]) + ("..." if len(ips) > 5 else ""),
+                    mac=mac,
+                    conflict_macs="",
+                    evidence_type="Proxy ARP 提示",
+                    risk_level="可疑",
+                    verdict="同一 MAC 对应大量 IP，更像 Proxy ARP/网关代理，需结合网络拓扑判断。",
+                    evidence=evidence,
+                )
+            )
+
+        return results
+
+    def build_scan_targets(self, adapters: list[dict], options: IpConflictOptions) -> list[str]:
+        if options.scan_range:
+            return parse_target_range(options.scan_range, options.max_hosts)
+        targets = []
+        for adapter in adapters:
+            targets.extend(parse_target_range(adapter_to_safe_range(adapter), options.max_hosts))
+        return list(dict.fromkeys(targets))[: options.max_hosts]
+
+    def refresh_arp_targets(self, targets: list[str], options: IpConflictOptions) -> None:
+        done = 0
+
+        def task(ip: str) -> None:
+            if self.stop_event.is_set():
+                return
+            run_hidden(["ping", ip, "-n", "1", "-w", str(options.timeout_ms)], timeout=max(2, options.timeout_ms / 1000 + 2))
+
+        with concurrent.futures.ThreadPoolExecutor(max_workers=options.workers) as executor:
+            futures = {executor.submit(task, ip): ip for ip in targets}
+            for future in concurrent.futures.as_completed(futures):
+                done += 1
+                if self.stop_event.is_set():
+                    for item in futures:
+                        item.cancel()
+                    break
+                try:
+                    future.result()
+                except Exception:
+                    pass
+                if done % 20 == 0 or done == len(targets):
+                    self.status(self._status("扫描中", 0, futures[future], risk_rank("正常"), len(targets), done, 0))
+
+    def get_address_states(self) -> dict[str, str]:
+        script = r"""
+$ErrorActionPreference = "SilentlyContinue"
+Get-NetIPAddress -AddressFamily IPv4 | Select-Object IPAddress,InterfaceIndex,AddressState,PrefixLength | ConvertTo-Json -Depth 4 -Compress
+"""
+        try:
+            result = run_hidden(["powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script], timeout=10)
+            if result.returncode != 0:
+                raise RuntimeError(result.stdout.strip())
+            data = extract_json(result.stdout)
+            if isinstance(data, dict):
+                data = [data]
+            return {item.get("IPAddress", ""): str(item.get("AddressState", "")) for item in data if item.get("IPAddress")}
+        except Exception as exc:
+            self.output(f"读取本机地址状态失败: {exc}\n", "warning")
+            return {}
+
+    def get_tcpip_conflict_events(self) -> list[dict]:
+        script = r"""
+$ErrorActionPreference = "SilentlyContinue"
+Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Tcpip'; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 80 |
+Select-Object TimeCreated,Id,ProviderName,Message | ConvertTo-Json -Depth 4 -Compress
+"""
+        try:
+            result = run_hidden(["powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script], timeout=12)
+            if result.returncode != 0 or not result.stdout.strip():
+                return []
+            data = extract_json(result.stdout)
+            if isinstance(data, dict):
+                data = [data]
+            events = []
+            for item in data:
+                message = str(item.get("Message", ""))
+                if re.search(r"conflict|duplicate|冲突|重复", message, re.IGNORECASE):
+                    events.append(
+                        {
+                            "time": str(item.get("TimeCreated", "")),
+                            "id": str(item.get("Id", "")),
+                            "message": message,
+                        }
+                    )
+            return events
+        except Exception as exc:
+            self.output(f"读取 Tcpip 系统事件失败: {exc}\n", "warning")
+            return []
+
+    def get_neighbors(self) -> list[dict]:
+        script = r"""
+$ErrorActionPreference = "SilentlyContinue"
+Get-NetNeighbor -AddressFamily IPv4 | Select-Object ifIndex,IPAddress,LinkLayerAddress,State | ConvertTo-Json -Depth 4 -Compress
+"""
+        try:
+            result = run_hidden(["powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script], timeout=10)
+            if result.returncode != 0:
+                raise RuntimeError(result.stdout.strip())
+            data = extract_json(result.stdout)
+            if isinstance(data, dict):
+                data = [data]
+            return [normalize_neighbor(item) for item in data]
+        except Exception as exc:
+            self.output(f"PowerShell 邻居表读取失败，尝试 arp -a: {exc}\n", "warning")
+            return self.get_neighbors_from_arp()
+
+    def get_neighbors_from_arp(self) -> list[dict]:
+        result = run_hidden(["arp", "-a"], timeout=10)
+        if result.returncode != 0:
+            return []
+        neighbors = []
+        current_interface = ""
+        for line in result.stdout.splitlines():
+            header = re.search(r"Interface:\s+([^\s]+)", line, re.IGNORECASE)
+            if header:
+                current_interface = header.group(1)
+                continue
+            match = re.match(r"\s*(\d+\.\d+\.\d+\.\d+)\s+([0-9a-fA-F-]+)\s+(\w+)", line)
+            if match:
+                neighbors.append(
+                    {
+                        "ifIndex": "",
+                        "interface_ip": current_interface,
+                        "ip": match.group(1),
+                        "mac": normalize_mac(match.group(2)),
+                        "state": match.group(3),
+                    }
+                )
+        return neighbors
+
+    def stop_detection(self) -> None:
+        if not self.is_running():
+            raise RuntimeError("当前没有正在运行的 IP 冲突检测")
+        self.stop_event.set()
+        self.output("\n正在停止 IP 冲突检测...\n", "warning")
+
+    def export_results(self, path: str) -> None:
+        if not self.last_results:
+            raise RuntimeError("还没有可导出的 IP 冲突检测结果")
+        fields = [
+            "adapter",
+            "ip",
+            "mac",
+            "conflict_macs",
+            "evidence_type",
+            "risk_level",
+            "verdict",
+            "address_state",
+            "local_mac",
+            "observed_macs",
+            "tcpip_event_count",
+            "gateway_mac_changes",
+            "ip_mac_changes",
+            "shared_mac_ips",
+            "scanned_hosts",
+            "notes",
+            "checked_at",
+        ]
+        with open(path, "w", newline="", encoding="utf-8-sig") as file:
+            writer = csv.DictWriter(file, fieldnames=fields)
+            writer.writeheader()
+            for row in self.last_results:
+                writer.writerow({field_name: row.get(field_name, "") for field_name in fields})
+
+    def copy_summary(self) -> str:
+        return self.last_summary
+
+    def normalize_options(self, options: Optional[dict]) -> IpConflictOptions:
+        options = options or {}
+        mode = options.get("mode", MODE_BOTH)
+        if mode not in {MODE_BOTH, MODE_LOCAL, MODE_SUBNET}:
+            mode = MODE_BOTH
+        return IpConflictOptions(
+            mode=mode,
+            scan_range=str(options.get("scan_range", "")).strip(),
+            workers=clamp_int(options.get("workers", 64), 1, 256, "并发数"),
+            timeout_ms=clamp_int(options.get("timeout_ms", 500), 100, 10000, "超时"),
+            max_hosts=clamp_int(options.get("max_hosts", 254), 1, 254, "最大扫描地址数"),
+            neighbor_samples=clamp_int(options.get("neighbor_samples", 3), 1, 5, "邻居表采样次数"),
+        )
+
+    def _select_adapters(self, adapter_name: str) -> list[dict]:
+        adapters = self._active_adapters(self.network.get_network_info())
+        if not adapter_name or adapter_name == ALL_ADAPTERS:
+            return adapters
+        return [adapter for adapter in adapters if adapter.get("name") == adapter_name]
+
+    def _active_adapters(self, adapters: list[dict]) -> list[dict]:
+        active = []
+        for adapter in adapters:
+            if not adapter.get("ipv4"):
+                continue
+            status = str(adapter.get("status", "")).lower()
+            if "disconnect" in status or "断开" in status:
+                continue
+            active.append(adapter)
+        return active
+
+    def _status(self, state: str, total: int, current: str, max_risk_rank: int, total_targets: int, completed: int, elapsed: float) -> dict:
+        return {
+            "state": state,
+            "total_adapters": total,
+            "current": current,
+            "max_risk": risk_from_rank(max_risk_rank),
+            "total_targets": total_targets,
+            "completed": completed,
+            "elapsed": elapsed,
+        }
+
+    def is_running(self) -> bool:
+        return bool(self.worker and self.worker.is_alive())
+
+
+def normal_result(adapter: dict, verdict: str) -> IpConflictResult:
+    evidence = IpConflictEvidence(address_state="", local_mac=normalize_mac(adapter.get("mac", "")), notes="未发现冲突证据")
+    return IpConflictResult(
+        adapter=adapter.get("name", ""),
+        ip=adapter.get("ipv4", ""),
+        mac=normalize_mac(adapter.get("mac", "")),
+        conflict_macs="",
+        evidence_type="本机 IP",
+        risk_level="正常",
+        verdict=verdict,
+        evidence=evidence,
+    )
+
+
+def filter_neighbors(samples: list[list[dict]], interface_index: str, interface_ip: str) -> list[dict]:
+    rows = []
+    for sample in samples:
+        for item in sample:
+            if item.get("ifIndex"):
+                if str(item.get("ifIndex")) == str(interface_index):
+                    rows.append(item)
+            elif item.get("interface_ip") == interface_ip:
+                rows.append(item)
+    return rows
+
+
+def build_neighbor_maps(neighbors: list[dict]) -> tuple[dict[str, set[str]], dict[str, set[str]]]:
+    ip_to_macs: dict[str, set[str]] = {}
+    mac_to_ips: dict[str, set[str]] = {}
+    for item in neighbors:
+        ip = item.get("ip", "")
+        mac = normalize_mac(item.get("mac", ""))
+        if not ip or not mac or is_special_mac(mac):
+            continue
+        ip_to_macs.setdefault(ip, set()).add(mac)
+        mac_to_ips.setdefault(mac, set()).add(ip)
+    return ip_to_macs, mac_to_ips
+
+
+def parse_target_range(text: str, max_hosts: int = 254) -> list[str]:
+    raw = text.strip()
+    if not raw:
+        return []
+    targets = []
+    for part in re.split(r"[,，;\s]+", raw):
+        item = part.strip()
+        if not item:
+            continue
+        if "/" in item:
+            network = ipaddress.ip_network(item, strict=False)
+            targets.extend(str(ip) for ip in network.hosts())
+        elif re.match(r"^\d{1,3}(?:\.\d{1,3}){3}-\d{1,3}$", item):
+            prefix, tail = item.rsplit(".", 1)
+            start_text, end_text = tail.split("-", 1)
+            start = int(start_text)
+            end = int(end_text)
+            if start > end:
+                raise ValueError("IP 范围起始值不能大于结束值")
+            targets.extend(str(ipaddress.ip_address(f"{prefix}.{value}")) for value in range(start, end + 1))
+        elif re.match(r"^\d{1,3}(?:\.\d{1,3}){3}-\d{1,3}(?:\.\d{1,3}){3}$", item):
+            start_text, end_text = item.split("-", 1)
+            start_ip = ipaddress.ip_address(start_text)
+            end_ip = ipaddress.ip_address(end_text)
+            if start_ip.version != end_ip.version:
+                raise ValueError("IP 范围两端必须是同一 IP 版本")
+            if int(start_ip) > int(end_ip):
+                raise ValueError("IP 范围起始值不能大于结束值")
+            targets.extend(str(ipaddress.ip_address(value)) for value in range(int(start_ip), int(end_ip) + 1))
+        else:
+            targets.append(str(ipaddress.ip_address(item)))
+    return list(dict.fromkeys(targets))[:max_hosts]
+
+
+def adapter_to_safe_range(adapter: dict) -> str:
+    ip = adapter.get("ipv4", "")
+    if not ip:
+        return ""
+    prefix = adapter.get("prefix_length")
+    if prefix in ("", None):
+        prefix = netmask_to_prefix(adapter.get("netmask", "")) or 24
+    try:
+        prefix = int(prefix)
+        if prefix < 24:
+            prefix = 24
+        network = ipaddress.ip_network(f"{ip}/{prefix}", strict=False)
+        return str(network)
+    except Exception:
+        parts = ip.split(".")
+        return ".".join(parts[:3]) + ".0/24" if len(parts) == 4 else ""
+
+
+def netmask_to_prefix(netmask: str) -> Optional[int]:
+    if not netmask:
+        return None
+    try:
+        return ipaddress.IPv4Network(f"0.0.0.0/{netmask}").prefixlen
+    except Exception:
+        return None
+
+
+def event_count_for_ip(events: list[dict], ip: str) -> int:
+    return len([event for event in events if ip and ip in event.get("message", "")])
+
+
+def build_summary(rows: list[dict], stopped: bool = False) -> str:
+    if stopped:
+        return "检测已停止，当前结果仅代表已完成部分。"
+    if not rows:
+        return "没有生成 IP 冲突检测结果。"
+    ordered = sorted(rows, key=lambda row: risk_rank(row.get("risk_level", "正常")), reverse=True)
+    highest = ordered[0]
+    conflict = [row for row in ordered if row.get("risk_level") == "冲突风险"]
+    suspicious = [row for row in ordered if row.get("risk_level") == "可疑"]
+    lines = [
+        "==== IP 冲突诊断摘要 ====",
+        f"最高风险: {highest.get('adapter', '')} {highest.get('ip', '')}  {highest.get('risk_level', '')}",
+        "结论基于本机 Windows 可见证据，建议结合交换机 MAC 地址表和现场设备确认。",
+    ]
+    if conflict:
+        lines.append(f"发现 {len(conflict)} 条冲突风险。")
+        for row in conflict[:5]:
+            lines.append(f"{row['adapter']} {row['ip']}: {row['verdict']}")
+    elif suspicious:
+        lines.append(f"发现 {len(suspicious)} 条可疑信号，建议复测或结合交换机侧信息确认。")
+        for row in suspicious[:5]:
+            lines.append(f"{row['adapter']} {row['ip']}: {row['verdict']}")
+    else:
+        lines.append("整体正常，未发现本机 IP 被其它 MAC 占用、同 IP 多 MAC 或 Tcpip 冲突事件。")
+    return "\n".join(lines)
+
+
+def normalize_neighbor(item: dict) -> dict:
+    return {
+        "ifIndex": str(item.get("ifIndex", "")),
+        "interface_ip": "",
+        "ip": str(item.get("IPAddress", "")),
+        "mac": normalize_mac(item.get("LinkLayerAddress", "")),
+        "state": str(item.get("State", "")),
+    }
+
+
+def extract_json(text: str):
+    output = text.strip()
+    json_start = min([idx for idx in (output.find("["), output.find("{")) if idx >= 0], default=-1)
+    if json_start < 0:
+        raise RuntimeError("未获取到 JSON 输出")
+    return json.loads(output[json_start:])
+
+
+def is_special_mac(mac: str) -> bool:
+    if not mac or mac == "00-00-00-00-00-00":
+        return True
+    return mac.startswith("FF-FF-FF") or mac.startswith("01-00-5E")
+
+
+def is_multicast_or_broadcast_ip(ip: str) -> bool:
+    try:
+        parsed = ipaddress.ip_address(ip)
+        return parsed.is_multicast or str(parsed).endswith(".255")
+    except ValueError:
+        return False
+
+
+def worse_risk(left: str, right: str) -> str:
+    return left if risk_rank(left) >= risk_rank(right) else right
+
+
+def risk_rank(level: str) -> int:
+    return {"正常": 0, "可疑": 1, "冲突风险": 2}.get(level, 0)
+
+
+def risk_from_rank(value: int) -> str:
+    if value >= 2:
+        return "冲突风险"
+    if value == 1:
+        return "可疑"
+    return "正常"
+
+
+def clamp_int(value, min_value: int, max_value: int, label: str) -> int:
+    try:
+        number = int(str(value).strip())
+    except ValueError as exc:
+        raise ValueError(f"{label}必须是整数") from exc
+    if number < min_value or number > max_value:
+        raise ValueError(f"{label}必须在 {min_value}-{max_value} 之间")
+    return number