I am a student trying to demonstrate an ARP spoofing attack. To test whether my attack was working I decided to use wireshark to sniff the packets on the attacking machine. At first I thought I was able to intercept traffic with my ARP spoofed setup, but I came to find that the reason I was able to see the packet was because wireshark is able to sniff promiscuously.
Now I'm reading some information about ARP Spoofing on Wikipedia, which says the following:
Generally, the goal of the attack is to associate the attacker's host MAC address with the IP address of a target host, so that any traffic meant for the target host will be sent to the attacker's host. The attacker may choose to inspect the packets (spying), while forwarding the traffic to the actual default destination to avoid discovery, modify the data before forwarding it (man-in-the-middle attack), or launch a denial-of-service attack by causing some or all of the packets on the network to be dropped.
If the ARP spoof spying only works on a local network because it is at layer2 and I'm able to sniff promiscuously on the same local network, is there any reason to prefer the ARP method? I recognize that it can be used for a MITM attack, but I'm asking about purely for spying. Is it possible to disable promiscuous listening? Using the commands
ifconfig enp0s25 -promisc and
ifconfig enp0s25 promise I am able to change this mode on my interface, but I don't notice anything immediately.