I use Cain to ARP spoof my host and the router. Then I use arp -an to show the ARP entries on my host. For a second or two, I can see the router's MAC address is changed to the address of the attacker, but it recovers to the router's valid MAC address immediately. Both Linux and Windows 7 are installed on my host, both have the same phenomenon. I use wireshark to sniffer the packets, there's no packets sending from the router. How to explain this?

2 Answers 2


Every time a host wants to communicate with another host on a local area network segment it must somehow determine its physical address (this is what a MAC address is, after all).

The process of physical address resolution occurs with the ARP protocol. This process consists of an exchange of ethernet frames in order to map logical addresses to physical addresses (most commonly, IP addresses to MAC addresses).

Now if this process happened every time 2 hosts wanted to exchange data on network segment, this would negatively impact the network performance -especially in cases where there is a large number of hosts that constantly communicate with each other.

To solve this problem, networked systems cache the physical address entries locally for a certain period of time. This way, each time a system wants to interact with another system on the local network, it looks up the physical-to-logical address mapping in a table stored in its memory. This is much, much faster than the address resolution process mentioned earlier.

The entries in the ARP cache are not permanent, though. They have a certain lifetime and once it expires they are refreshed again through a new ARP lookup. This method minimizes the global number of ARP lookups required for communication and at the same time keeps the logical-to-physical address mappings up-to-date.

In order to "preserve" an ARP Man-In-The-Middle situation, you need to constantly spoof the MAC addresses in order to keep them in the ARP caches of the targeted systems for the duration of the attack.

The lifetimes of ARP cache entries are implementation-dependent and vary from operating system to operating system.

You mentioned that you didn't see any "packets" in Wireshark, therefore I assume you were capturing IP traffic. The ARP look-ups occur on a lower level (Layer 2) and it uses ethernet frames and not IP packets for data exchange.


I'll go ahead and preface this with the obligatory "I'm not a networking expert" statement, but if I remember correctly, this behavior has to do with resolution of IP address conflicts. Essentially, the router is broadcasting an ARP announcement in an attempt to determine if there are any other hosts on the network with its IP address. When the connected hosts receive the ARP announcement, their ARP cache is updated with the MAC and current IP of the router.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .