I have a basic lab with one Win7 VM in a LAN and another (vyos) serving as the default gateway.
When I start my Kali Linux VM (it is attached to the same LAN segment) I can see ping requests and replies in Wireshark between the Win7 VM and the router (vyos). I don't understand how this is possible. I haven't started any ARP spoofing attack yet, and on the Kali box when I look at the trace I can see that the L2 and L3 addressing is matching the LAN Host's and routers addressing, so what is going on?
EDIT: Also, the NIC of the Kali VM is set to promiscuous mode but this got me thinking that in a physical Ethernet environment we would not see the packets anyway, we would have to configure SPAN / mirroring on the switch to first mirror the packets to the port on which we are listening in promiscuous mode.
So the question is, are virtual environments good enough for this type of task? Or should I stick to a physical switch? For now they seem to be rather confusing.
So here's what I do next: a) create a static arp entry on Win 7 to map the default gateway's IP to it's MAC b) on Kali Linux on it's corresponding NIC - disabled promiscuous mode c) started ettercap and discovered all hosts (it discovers the Win7 and vyos VM) d) select the targets respectively e) start ARP spoofing attack - i can see on the Windows 7 box a fake ARP replay toward the Win7 VM f) also XARP on the Win7 box reports something "unusual":
g) I then check the arp table on the Windows 7 box and it looks ok, I mean the static entry was not overwritten and the dynamic entry is fine too, because it maps the Kali's IP to it's MAC
h) but when I start Wireshark on the Kali VM I can see the ICMP packets, but WHY? OK, I just figured it out. In fact I can see only the Echo Replay's from the gateway to the Windows7 because the arp table on the router (vyos) does not contain any static mappings, hence it's directs all traffic through the Kali VM, but the traffic from the Win7 VM is going directly to the router.