in a scenario where I have a gateway to the Internet and a switch(layer 2) connected to this gateway. I have two computers in the same broadcast domain connected to the switch. all traffic to the Internet has to go through the gateway.
from one of the computers I ARP poison the other by sending false ARP reply's indicate this computer is the gateway. so now one of the computers thinks the other is the gateway. then I ARP poison the gateway for this same victim computer and now one of the computer is acting like MITM this is working and I can see the ARP caches have changed MAC address. all internet traffic can be sniffed (ignore SSL for this experiment). only traffic issued via the gateway can be sniffed as one computer is in the middle.
let's say a web server is added to the switch and the traffic from both computers on the same switch do not have to go through the gateway to access the web server because the switch has an CAM table and traffic from computer goes to switch and the switches CAM cache says MAC address is on port x so basically traffic does not go via gateway. in this scenario how does one act as MITM ?
do you arp poison or something similar the switch it is a layer 2 switch? how do arp poison a switch for a MITM attack ?
I feel like I am missing something simple
my experiment allowed me to sniff all traffic going to the Internet but I could not sniff the traffic going to the web server sitting on the switch. maybe I "simply" arp poison the web server arp cache and again arp cache the victim computer ?
yes port forwarding is enabled just in case it's asked.