I would like to perform arp spoofing on an existing tcp connection between a server and a client and perform a mitm attack. In addition to altering existing packets, I would like to be able to inject my own packets into the connection without disturbing the legitimate flow of packets. As I understand, this would require handling seq and ack numbers that are out of sync between the client and the server, as the server will receive more packets than the client sent. Is there a good tool for this?

2 Answers 2


What you ask is far less straightforward than you think. However, you can start with Scapy which is a widely employed and a fairly easy to use python library. All you need to start is a decent knowledge of Python and the fundamentals of computer networks.


As suggested by @schroeder Scapy is a good tool, especially if your attack is quite specific and you need scripting capabilities. You can certainly alter a packet, while keeping seq and ack numbers, and recalculate checksums. Here is one post on SO that explains how to do it with Scapy.

Personally, in a physical pentest scenario, I would use a dual ethernet SBC (single board computer) such as an Orange PI or similar device, and I would set up a transparent bridge to intercept traffic and alter it selectively.

On a NAC-enabled connection (802.1x) an attack is more difficult but still possible, tools like Fenrir can help perform packet injection.

The MITM device could also, rather than relay or manipulate traffic from the client, spoof the client itself by cloning its MAC address.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .