0

I have a virtual machine of Kali Linux and trying arp spoofing using the arpspoof tool I installed on Kali. I am trying to test out how I would stop devices from accessing the Internet.

I have tried spoofing the router's MAC address by using arpspoof -i wlan0 -t (victim ip) (router ip).

I run arp -a on my victim machine and it works as expected (the router's IP is associated with my Kali's MAC address and when I ping the router on the victim machine it doesn't get any replies from the router.

HOWEVER, I can still use the internet. How is this possible? If I can't get any replies from the router shouldn't the internet not work?

(And yes... I am doing this on my own network)

Improve this question
2
  • 1
    Whenever troubleshooting network flows always run a packet capture so that you can see what's happening on the wire.
    – schroeder ♦
    Feb 10 at 14:15
  • Did you flush the victim's ARP table?
    – schroeder ♦
    Feb 10 at 14:16

1 Answer 1

Reset to default
-1

I'm not certain but I suspect an already established TCP connection no longer needs ARP. A better fit for your question would be here:https://networkengineering.stackexchange.com/

Improve this answer
2
  • "but I suspect an already established TCP connection no longer needs ARP"- it still needs to know which MAC address to send the data to. Some systems (like Linux) don't always do ARP requests to learn about the MAC address of the peer. If they receive a packet from the peer (which is the case for an established TCP connection unless it is idle) then they will update their ARP table based on the mapping between MAC and IP address from the received packet.
    – Steffen Ullrich
    Feb 10 at 18:06
  • Oh I see.. So an already established TCP wouldn't be allowing the victim's device to access the internet?
    – Flqmmable
    Feb 11 at 5:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .