I am attempting to perform a MITM attack via ARP spoofing to sniff out the traffic from
10.0.0.55. Here is my setup:
echo 1 > /proc/sys/net/ipv4/ip_forward sudo arpspoof -i wlan0 -t 10.0.0.54 10.0.0.1 sudo arpspoof -i wlan0 -t 10.0.0.1 10.0.0.54
My knowledge is that this captures all traffic from
10.0.0.54. However, based on my analysis of
tcpdump, I am only capturing external traffic (any public IP addresses) and not capturing any internal traffic (private IP addresses).
Can someone tell me why this would be the case? Should I send my ARP requests elsewhere?