- Attacker (also having SSH server installed):
- SSH server:
I perform a successful ARP Spoofing attack (being obviously the attacker's MAC address):
But when I try to connect via
ssh email@example.com, instead of connecting to the attacker's ssh server, it redirects the traffic to the real ssh server (or keeps waiting for this connection if traffic redirect is disabled in attackers
Is there any way I could interpret packets coming from an IP before redirecting to the original destination?
Note: in case it's relevant, I'm using Ubuntu docker containers inside GNS3 inside a VM. This is the scheme: