I'm learning about arp spoofing and I'm a bit confused as to how it works.
From what I gather you are on a LAN network with a victim and connected to a router. You then tell the router that you are the victim, and the victim that you are the router. The victim and the router both store this bad information in their arp cache and will send information to you, which you relay to the other side while being able to read/edit it.
What I don't understand is why the MAC address stays in the arp table. If you are telling the victim that you are the router and the real router is telling the victim that they are the router wouldn't the victim's computer automatically use whichever router it was using before?
Similarly, if the real victim and you are both telling the router that you are the victim, wouldn't the router just detect what you're trying to do and remove you from the network?
I'm sorry if this is a stupid question but LAN hacking in general is relatively new to me.