In ARP spoofing, the victim broadcasts to MAC ff:ff:ff:ff:ff:ff asking for MAC address of router IP. The attacker can respond with his own MAC, but the router responds with its MAC!

If I try "man in the middle", my MAC (attacker) is always accepted, which means the router MAC was rejected. Why?

My guess is that the attacker response is faster. If true or false, how or why?


Not about faster, the attacker machine floods ARP responses even if no one requested one. When machines receive these packets, they update their ARP tables. The attacker wins simply because it is constantly telling everyone it is the router every second.

The phrase you are looking for is "gratuitous ARP".

| improve this answer | |
  • ok, win means faster – Error Nov 1 '16 at 22:25
  • @Error no - win means 'more', not 'faster', even when the router sends its update, the client uses it, but then it is overridden a second later by the attacker. – schroeder Nov 1 '16 at 22:36
  • to ask the right question, can you make that clear for me. what is the previous step (what invoke the broadcasting) does arpspoofing tool send new arp request using ip of victim and response with victim mac? – Error Nov 1 '16 at 22:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.