i was just testing something about MITM i know MITM well attack is just like: gateway = victim = attacker = performing mitm and enable linux kernel ip_forwarding and i see outgoing traffic for victim i just wanted to know how to capture incoming traffic for is that is possible ? i see in wireshark a DNS request to from victim but i didnt see the response traffic from to victim probably because forwarding packets contains IP src= so real gateway at send incoming traffic for directly how to fix this could be fixed by sending ARP saying is at attacker_mac ?

another question:

if now at attacker mac and at attacker mac and attacker has ip_fowarding isnt it causing a conflict as also gateway will say that at his gateway and also vicitm machine will say at its mac so vicitm outgoing traffic will go to both attacker and gateway ? and attacker will forward the same traffic that already had been sent also the sameway in incoming traffic !!


  • It's really hard to read your "another question". Please consider using puncuation and short sentences, making clear what your actual question is. As of now, I can only guess what you want to know.
    – GxTruth
    Commented Jul 9, 2018 at 14:05

1 Answer 1


In order to truly man in the middle them you'll need to arpspoof them. By arp poisoning the router and your target, you can make them both forward traffic to you instead of each other. Then you forward it on, after inspecting it or modifying it.

assuming you're on kali or parrot

echo 1 > /proc/sys/net/ipv4/ip_forward

arpspoof -i <your interface> -t <router ip> -r <target ip>

arpspoof -i <your interface> -t <target ip> -r <router ip>

at this point you can either start wireshark, mitmf, etc etc etc


What is arp spoofing

Tutorial on MiTM With kali

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .