Arpspoof

[Mutt]

Good day, today we will consider the arpspoof tool.

arpspoof captures packets on a switched LAN. arpspoof redirects packets from a target host (or all hosts) on the local network to another host on the local network by spoofing ARP responses. This is a very efficient way to sniff traffic on the switch.
IP forwarding by the kernel (or a user environment program that does the same, such as fragrouter) must be enabled beforehand.
Homepage: https://github.com/smikims/arpspoof

The program is preinstalled in Kali Linux.

Usage:

arpspoof [-i interface] [-c own | host | both] [-t target] [-r] host

Arpspoof launch examples
To tell the victim's host that we (our MAC address) are now one of the gateway's IPs, enter the following command:

arpspoof -t victim

In a separate shell, we will run the appropriate command to fool the gateway into believing that we are the victim:

arpspoof -t victim_gateway

Remember to enable IP forwarding on your host so that traffic leaves your host. Otherwise, the victim will lose the connection.

echo 1> / proc / sys / net / ipv4 / ip_forward

Now to view all traffic between the victim's host and the external network going through your machine

tcpdump victim_host_and_not_arp

Fighting arpspoof
Use tools like arpwatch to monitor MAC / IP table changes.

Arpspoof manual

OPTIONS
-i interface
Specifies the interface to use.

-c own | host | both
Determines which hardware address t to use when restoring arp configuration; during cleaning, the bags may be
sent with their own address as well as with the host address. Sending packets with a fake hardware address can destroy
connecting to a specific switch / application / bridge configuration, however, it works more reliably than using
own address, which is the default way to clean up arpspoof afterwards.

-t target
Specifies a specific host for ARP poison (if not specified, all hosts on the local network). Repeat to set up multiple hosts.

-r Spoof both hosts (host and target) to capture traffic in both directions. (only valid when paired with -t)

host Specifies the host on which you want to capture packets (usually the local gateway).