As far as know, simplest way to reproduce same situation is to use arpspoof. I have tested this, and it works only partically. I mean it does indeed redirect traffic from victim (test Macbook) to gateway (Asus router) and vice versa. Pings are working fine between both. But upon entering any website from the internet, it is loading so slowly that it is impossible to work with it. arpspoof sends 2 gratuitous ARP packets (1 for victim, one for gateway) each 2 seconds.
I was wondering how does CUJO and Firewalla work with unvisible performance drop, if home-made tests using arpspoof are not working as expected?
(Yes I have packet forwarding enabled within /proc/sys/net/ipv4/ip_forward)
- Victim = Macbook Air (192.168.10.34) (connected via WiFi)
- Attacker = HP notepad with Debian 9 (192.168.10.48) on Gigabit port
- Router (Asus) = (192.168.10.1)
I have tested my Android phone aswell with WiFi, and same thing, internet pages are opening very slowly if not at all.