I'm wondering why ARP table in my laptop returns to its initial state when arpspoof tool attack is stoppped.

Is there any option for the attacker to modify the victims ARP table until the default gateway sends a new ARP response with its legitimate MAC-IP pair even if the attack tool is stopped?

Thank you.

up vote 1 down vote accepted

The ARP cache will be updated any time new information is available. This could be due to an ARP announcement, or simply based on entry expiration (for example: the default expiration time is 1 minute on linux).

If you want the spoofed entries to remain in the cache, you have to keep sending ARP messages.

Be aware that various OSes and configurations may make ARP spoofing less effective. You can read more about some of the methods in the wikipedia entry. If you want to know exactly why you are seeing you behavior, you may want to include more details (OS, actual ARP table entries, timing information, etc..).

  • Thank you for your answer @Marc it is exactly what I was looking for. – elena.bdc Jan 1 at 14:24

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.