Return to Revisions

With no attack, an ARP table might look like:

192.168.0.1    11-11-11-11-11-11
192.168.0.20   22-22-22-22-22-22
192.168.0.30   33-33-33-33-33-33  <--about to attack

When the attack launches, an entry in the ARP table is overwritten with the attacker's MAC.

192.168.0.1    11-11-11-11-11-11
192.168.0.20   33-33-33-33-33-33
192.168.0.30   33-33-33-33-33-33  <--attacking

So, yes, there are multiple IP entries for the one MAC.