first of all i have a basic questions regarding network traffic:
All Devices in the network are connected with WLAN and a Router. If i send a message from my computer to a other device in the network per IP my computer looks in the arp table for the mac adress of that ip. If not found send arp broadcast looking for that ip. If found, form a packet with destination mac from the target device(NOT the mac from the router) and send it. The Router receives this packet and (now acting as a layer 2 switch) looks in his mac adress table (sat) for this target mac and send it there.
Is this correct?
Now to my Problem with arpspoofing. Three Devices are involved:
Attacker running Kali: x.x.x.105 (34:F3:xx:xx:xx:xx) Target running Win10: x.x.x.107 (80:56:xx:xx:xx:xx) Router: x.x.x.1 (44:6e:xx:xx:xx:xx)
Attacker has IP Forwarding enabled.
I now started two instances of arpspoof:
arpspoof -i wlan0 -t x.x.x.107 x.x.x.1 arpspoof -i wlan0 -t x.x.x.1 x.x.x.107
At the attackers Wireshark i can see all outgoing arp replies. They also say multiple IP usage detected! Arp Table cleared after arpspoof started. Spoof is running for nearly an hour.
However at my targets Wireshark i can't see incoming arp messages from attacker.
The arp table at windows does not change. Also my Router don't seem to update it's arp table.
I can't find the Problem here. Is Win10 blocking arp replies not requested?
This is for education purposes only. Thank you