i was just testing something about MITM i know MITM well
attack is just like:
gateway = 192.168.1.1
victim = 192.168.1.13
attacker = 192.168.1.6
performing mitm and enable linux kernel ip_forwarding and i see outgoing traffic for victim 192.168.1.13
i just wanted to know how to capture incoming traffic for 192.168.1.13 is that is possible ?
i see in wireshark a DNS request to
22.214.171.124 from victim but i didnt see the response traffic from 126.96.36.199 to victim probably because forwarding packets contains IP
src=192.168.1.13 so real gateway at 192.168.1.1 send incoming traffic for 192.168.1.13 directly how to fix this could be fixed by sending ARP saying 192.168.1.13 is at attacker_mac ?
if now 192.168.1.1 at attacker mac and 192.168.1.13 at attacker mac and attacker has ip_fowarding isnt it causing a conflict as also gateway will say that 192.168.1.1 at his gateway and also vicitm machine will say 192.168.1.13 at its mac so vicitm outgoing traffic will go to both attacker and gateway ? and attacker will forward the same traffic that already had been sent also the sameway in incoming traffic !!