0

I'm doing some experimenting with Kali on my home network and was wondering about something regarding ARP spoofing.

When I ARP spoof another device AND the default gateway, Internet access stops working for said device. To get it working, I must enabled the http & https proxies.

What I'm trying to figure out is why does it break? My understanding of the ARP spoofing process and traffic flow is:

  1. After succesful arp poisoning, the end device sends constructs its packet destined for a web server living on a public IP address. The frame header shows my device as the target MAC address
    1. When I receive the frame, it is my understanding that I will simply rewrite the destination MAC address and sent the frame back out the interface
    2. The gateway will receive the frame and rewrite the IP header (NAT) and send it out to the internet
    3. When the gateway receives the reply, it consults the NAT translation table and rewrites the destination IP address. Gateway then checks its ARP table and sees me as the target MAC address for the arp poisoned devices IP address
    4. Gateway writes the frame and my MAC adddress is down as the destination
    5. I receive the frame, and then rewrite the destination MAC address so it still gets to the original source device

So, with that in mind, i'm struggling to understand at what point external communications break down?

Improve this question
3
  • Enable IP forwarding. net.ipv4.ip_forward = 1 in /proc/sys/net/ipv4/ip_forward
    – defalt
    Aug 11, 2019 at 19:15
  • I have ip forwarding enabled, still no dice. The Internet seems to 'break' at the DNS level. I confirm ARP spoofing is working by looking at the ARP table on my poisoned device. I can then ping externally (8.8.8.8) but any attempt to resolve DNS fails, by the way my DNS server is set to 8.8.8.8 also. Any ideas?
    – Ed Jones
    Aug 12, 2019 at 17:00
  • Just an update on this; it turned out to be some kind of protection feature on the gateway. I tried another gateway and everything works fine.
    – Ed Jones
    Aug 13, 2019 at 17:18

1 Answer 1

Reset to default
1

"It breaks cause you dont forward the packets"


Basically in an ARP spoof attack you tell the victim you are the router and to the router that you are the victim.So all the traffic basically flows through you.But you need to enable ip_forwarding to actually transmit packets from your device to the router,that is why it "BREAKS" the internet for the victim,cause you are not forwarding the packets to the router and back.

Improve this answer
3
  • I have ip forwarding enabled, still no dice. The Internet seems to 'break' at the DNS level. I confirm ARP spoofing is working by looking at the ARP table on my poisoned device. I can then ping externally (8.8.8.8) but any attempt to resolve DNS fails, by the way my DNS server is set to 8.8.8.8 also. Any ideas?
    – Ed Jones
    Aug 12, 2019 at 16:59
  • Must be some networking issues then.Too broad to help you
    – yeah_well
    Aug 12, 2019 at 17:10
  • It's very strange, I've used wireshark on the poisoned device, i can see ICMP replies coming back from 8.8.8.8 with the source MAC address showing as the device that did the poisoning, so this suggests the router is sending frames to the posioned device via my other device doing the poisoning. But, for some reason, TCP and UDP don't work.
    – Ed Jones
    Aug 12, 2019 at 17:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .