I'm wondering why ARP table in my laptop returns to its initial state when arpspoof tool attack is stoppped.

Is there any option for the attacker to modify the victims ARP table until the default gateway sends a new ARP response with its legitimate MAC-IP pair even if the attack tool is stopped?

Thank you.

1 Answer 1


The ARP cache will be updated any time new information is available. This could be due to an ARP announcement, or simply based on entry expiration (for example: the default expiration time is 1 minute on linux).

If you want the spoofed entries to remain in the cache, you have to keep sending ARP messages.

Be aware that various OSes and configurations may make ARP spoofing less effective. You can read more about some of the methods in the wikipedia entry. If you want to know exactly why you are seeing you behavior, you may want to include more details (OS, actual ARP table entries, timing information, etc..).

  • Thank you for your answer @Marc it is exactly what I was looking for.
    – elena.bdc
    Jan 1, 2018 at 14:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .