I have understood the basic concept of how arp-spoofing works. However, I am struggling with the details.
Why does an attacker have to constantly send out spoofed arp-announcements to the network?
Is a client only accepting the first arp-announcement that arrives after the request for a certain MAC address of an IP address (meaning that the constantly sent out spoof-reply is faster than the reply with the actual MAC address) or are all clients regularly updating their caches by listening to arp-announcements on the network?