I'm a computer security student whom has recently been tasked with conducting an arp spoofing attack on a couple devices on a test network. The issue I'm facing is that none of the devices seem to be responding to any sort of arp spoofing. I can run nmap and scan through the network and see all the devices that are connected to the same AP as I am, so I know I can at least see the devices.

Note: The network is a PEAP network with mschapv2

So my question is: When conducting an arp-spoof attack on a network, can a router detect, and then throw away bogus arp-replys?

  • how often are you sending ARP spoofing replies?
    – schroeder
    Apr 2, 2015 at 17:21
  • So I've been using MITMF from kali, and it looks like it sends it out every second.
    – user71642
    Apr 2, 2015 at 17:43
  • when you run a packet capture, can you see traffic from the other devices?
    – schroeder
    Apr 2, 2015 at 17:49
  • No I haven't been able to see any traffic
    – user71642
    Apr 2, 2015 at 17:56
  • If you have not been able to see traffic from them, it is possible that the network is set up in such a way that you need to address the ability to communicate directly with the hosts before you can poison their ARP caches.
    – schroeder
    Apr 2, 2015 at 18:10

2 Answers 2


Is your computer in the same subnet than the target devices? Because ARP only works between devices in the same IP subnet.

But if the two IP Addresses are on different subnets, the device will follow a completely different logic: it will look in its routing table for a route to the destination network, and then it will send its packet to the appropriate router (or to its default gateway if no more specific route is present); in this scenario, ARP will be used to find the hardware address of the router, because the destination IP address has already be deemed to not be directly reachable, so the packet must be delivered to a router which can take care of it.

Look in here for a better explanation.


You mention PEAP with MSCHAPv2. This is WPA2 Enterprise?

In the university I work at, our network (eduroam) blocks all packets between clients. That is, you can't ARP spoof someone else on the network.

If you happen to be using that network (IST/ULisboa?), or a network where the same was made, I'd tell you to get a real test network.


You don't mention the operating system of the target device. The only thing that occurs to me is that, if you are sending gratuitous ARP replies, whether they are respected or not depends on the operating system.

I know that some Windows and MacOS X (that I've tested) respect them by default. At least the vanilla Debian Linux Wheezy/Jessie don't accept them by default.

$ cat /proc/sys/net/ipv4/conf/all/arp_accept

If you want that device to respect gratuitous ARPs,

$ sudo tee /proc/sys/net/ipv4/conf/all/arp_accept <<< 1

and then test again.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .