I want to capture all internet traffic on a small network, so I am experimenting with ARP spoofing of the default gateway but I don't see the spoofed ARP cache entries.
I am using two Linux machines on the network, one - the attack machine - runs
ettercap and the other plays the role of victim. The third partipant is the default gateway which is a typical ADSL router. There are other devices on the network. All devices are connected over ethernet (wired).
ettercap (version 0.8.2) like this:
ettercap -T -j ettercap.hosts -M arp:remote -w ettercap.pcap /10.0.0.10/ //
ettercap.hosts contains the hosts on the network (being a class A, a scan isn't practical) and the IP address is that of the default gateway.
arp on the victim shows that it has the correct MAC for the default gateway but I would expect it to show the MAC for the machine running
ettercap. I see similar on the router: it has the correct MAC for the victim machine. I expected the arp caches to be modified to point at the attack machine.
wireshark on the victim machine shows that ARP packets are being sent by
ettercap but they don't have any effect. For example:
136 13:50:12.666418095 Sony_8d:3f:5e AsustekC_b9:59:24 ARP 60 10.0.0.10 is at 00:01:4a:8d:3f:5e
I presume that I misunderstand or am missing something but I am not clear what.
What is the right way to use
ettercap to arp spoof the default gateway to log all traffic ?