Using ettercap and ARP poisoning, I was able to eavesdrop on other connections, but suddenly I was unable to make any connection to the Internet. To restore Internet connectivity, I had to restart my router. (I have tested this on 3 different routers: sagem, linksys and huawei.)

Am I doing something wrong or is there a safety mechanism that kills all network activity?

  • Can you elaborate on where you were performing the ARP poisoning and how it relates to your Internet connection? – schroeder Sep 12 '12 at 15:13
  • Did you tried ping? test . Did you tried remove arp cache entries from victim computer and trying then. – Saladin Mar 9 '13 at 15:34
  • Look at the ARP cache of your router to see the problem. – dan Apr 20 '16 at 9:27

ARP spoofing usually works by fooling all the clients into thinking that you're the router, by faking the ARP responses that translate IP addresses to MAC addresses. When clients receive the ARP response, they remember the MAC that was associated with the IP.

Once you stop the application that's handling the man-in-the-middle part of the operation, the clients keep sending to your MAC address, instead of the router's. Since you're no longer handling such packets, the traffic is blackholed and the whole network goes down. Resetting the router causes it to send an ARP broadcast (e.g. "Hi, I'm at 12:34:56:78:90:AB") along with a DHCP broadcast, allowing clients to re-sync with the real router.

It may be possible for your ARP poisoning software to send out an ARP broadcast when it closes, with the real MAC address of the router, in order to prevent this. This may be a bug, or it may just not be implemented yet.

  • 8
    IIRC it's also possible to ARP poison only one machine (i.e. don't respond to all ARP queries, just those from a specific host). That method is much less likely to cause disruption.. – Rory McCune Sep 2 '12 at 12:47
  • yes I am aware of that you saying, but the think is that I don't stop application that's handling the man in the middle so I am wondering what is happening... – Stelios Joseph Karras Sep 2 '12 at 13:42
  • 1
    @jkarr It might be that your tool isn't working properly. Try analysing your network with a tool like Wireshark, to see what ARP packets are being broadcast. – Polynomial Sep 2 '12 at 14:46

Another addition to the forwarding/routing points people have made, if you are running a Linux based OS, you will need to turn on IP forwarding, otherwise the kernel will just drop any packets destined for an IP address that isn't attached to any local interface.

You can turn on ip_forwarding by running (as root);

echo "1" > /proc/sys/net/ipv4/ip_forward

And likewise turn it off again with;

echo "0" > /proc/sys/net/ipv4/ip_forward

This will have immediate effect, and does not require a reboot.


If you only have one network interface card, you may be blackholing everything. You would need one nic (or virtual nic) to connect to the clients and act as the spoofed router/switch and one to forward traffic on to the switch. I know that ettercap can handle this for MiTM'd traffic, but don't recall if it also provides your machine with internet access.

When you exit from ettercap, it should re-establish internet connectivity by sending out the correct arp packets to the currently MiTM'd victims, cutting you out of the middle and re-establishing their internet connectivity.

Make sure that when you MiTM you aren't MiTM'ing the router for yourself as well.


This problem also used to happen to me, and in my case, everything had to do with the use of iptables. I was using iptables without the (-i) interface parameter causing the redirection through my machine to not work, because iptables has no way to know which interface you need to redirect traffic to. I just changed my command and no more DoS on the network:

iptables -t nat -A PREROUTING -i wlan0 -p tcp --destination-port 80 -j REDIRECT --to-port (the port port where your going to have sslstrip listening to)

Remember to change the interface according to what kind you are using ex. in my case I'm connected to a wlan. If you are connected with a wired connection most likely your interface would we eth0.

This worked for me on Ubuntu 14.4.


Your question seems to indicate that you were running Ettercap on the Internet ... ISPs often have ARP spoofing detection and would cut you off when they saw your malicious activity.

  • Instead of making the assumption you should ask if he is running Ettercap via comments – user69377 Aug 31 '15 at 4:22
  • @KagueiNakueka The OP specifically states he is running Ettercap. Also you will note that I did ask for more details. – schroeder Aug 31 '15 at 5:00

In my experience, HTTP traffic (from an android client) is forwarded correctly on mountain lion running ettercap, but HTTPS breaks down. SSLStrip also failed (so far, for me).

  • This doesn't really answer the question. – Adi Mar 9 '13 at 19:59

I normally use arpspoof from the dsniff package. This one sends out broadcasts automatically after you terminate spoofing, informing the target IP(s) of the real MAC address for the router.

Normally ettercap has this functionality too so this might be an issue with your system (package version, OS) or improperly terminating your cli program (2Xctrl+c, ctrl+d)


It has happened to me as well. I would put my bet on redirection or forwarding problems. What is required is that on iptables you must configure to sent it to destination. Right mow it just turned into blackhole for you.

"sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 666" ### iptables will forward port 80 to our box, running sslstrip on port 666.

Ref sslstrip

I hope the above commands help you configuring your IPtables.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.