Ettercap Remote Poisoning

Question

I have a question about one parameter and that's it.

When I'm doing DNS spoofing I have to use arp:remote. Can someone explain to me what arp:remote means?

I read the man page, but did not understand it so clearly. I'd be glad if someone helped me :)

Man page of ettercap - arp:remote

The parameter "remote" is optional and you have to specify it if you want to sniff remote ip address poisoning a gateway. Indeed if you specify a victim and the gw in the TARGETS, ettercap will sniff only connection between them, but to enable ettercap to sniff connections that pass thru the gw, you have to use this parameter.

Answer 1

Remote means that traffic will be intercepted in both directions; I.e. bidirectional arpspoofing so that traffic destined for the victim is intercepted as well. This is so any DNS replies can be spoofed by the attacker before reaching the victim.

Answer 2

Basically, by default ettercap will not sniff connections that are destined for the internet, and the other way around:

  Internet
     |
     | arp:remote sniffing will ALSO sniff these connections. 
     |
  Gateway
     |
     | arp default sniffing will only sniff connections between gateway and victim PC
     |
 Victim PC

DNS requests/answers are destined for the Internet, and thus only intercepted when using arp:remote.