I set up a home network using a switch and 3 computers, all having the newest Ubuntu.

enter image description here

I want to perform an arpspoofing along with MITM such that the attacker can see messages sent between client and a server.

On server, I set up a nc server, like this: nc -l 4444 on client I connect to server: nc 4444 and everything works great. There's no gateway address on machines, only IP and mask.

However, when I do ARP spoofing, messages can't be sent. I'm sending and nothing's happening. When I stop arpsoof, messages can be sent.

On attacker, I do:

sudo arpspoof -i eth0 -t
sudo arpspoof -i eth0 -t
sysctl -w net.ipv4.ip_forward=1

And it does not work. I can't see messages between client and server, and I can't even send messages from client to server when I start arpsoof.

When I run Wireshark on the attacker, I saw only ARP requests being sent. The interface name is OK.

What can be wrong here?

  • And did you look up the ARP tables on the targets?
    – schroeder
    Commented Mar 3, 2023 at 11:45

1 Answer 1


Both client, server or your network might have mitigations against ARP Spoofing. On the network side it might be your WiFi router or virtualisation hypervisor. To validate you might need to inspect if ARP table on client contains attacker MAC by running:

ip neigh show

on Linux or

arp -a

on Windows. If it is then you check for SYN TCP send to attacker. If it is also OK then you need to check way back on server along with potential routing problems.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .