I am unable to understand fully how ARP spoofing attacks are successful.
Assuming three PCs are connected to a single switch
PC-1 - IP address 192.168.1.1, MAC: AA:AA:AA:AA:AA:AA
PC-2 - IP address 192.168.1.2, MAC: BB:BB:BB:BB:BB:BB (ARP Spoofer)
PC-3 - IP address 192.168.1.3, MAC: CC:CC:CC:CC:CC:CC
So when PC-1 pings 192.168.1.3, it will broadcast an ARP request and PC-2 will respond saying that I am 192.168.1.3 and my MAC is BB:BB:BB:BB:BB:BB
After PC-1 adds this ARP reply to its table, the ping packet from PC-1, will have a Destination IP address of 192.168.1.3 and a destination MAC of BB:BB:BB:BB:BB:BB.
The ARP spoofer NIC (PC-2) will recieve this frame because it is addressed to its MAC address, but wouldn't the packet be dropped as it passed up the TCP/IP stack at the IP layer as as the ARP spoofer has a different IP (192.168.1.2) to the destination IP of the packet (192.168.1.3)?