I have a question about one parameter and that's it.

When I'm doing DNS spoofing I have to use arp:remote. Can someone explain to me what arp:remote means?

I read the man page, but did not understand it so clearly. I'd be glad if someone helped me :)

Man page of ettercap - arp:remote

The parameter "remote" is optional and you have to specify it if you want to sniff remote ip address poisoning a gateway. Indeed if you specify a victim and the gw in the TARGETS, ettercap will sniff only connection between them, but to enable ettercap to sniff connections that pass thru the gw, you have to use this parameter.


Remote means that traffic will be intercepted in both directions; I.e. bidirectional arpspoofing so that traffic destined for the victim is intercepted as well. This is so any DNS replies can be spoofed by the attacker before reaching the victim.


Basically, by default ettercap will not sniff connections that are destined for the internet, and the other way around:

     | arp:remote sniffing will ALSO sniff these connections. 
     | arp default sniffing will only sniff connections between gateway and victim PC
 Victim PC

DNS requests/answers are destined for the Internet, and thus only intercepted when using arp:remote.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.