Wireshark shows that an IP address belongs to two different MAC addresses:


I spoofed ARP, and I use VMware.

How can I fix this? How is it possible that one IP address can belong to two different MAC addresses? Is it related to my use of VMware? Is something wrong in my ARP spoofing? How is that possible?

Is it normal when I open arp -a on the victim machine and it says that one IP address has two different MAC addresses?

I did arp spoofing on my router and another computer. My other computer is the victim. When I open cmd on the victim computer, and I run arp -a it says:

Screenshot of arp -a result

How is this possible? It happened after the ARP spoof.

  • What is your question?
    – Ron Maupin
    Oct 29, 2015 at 15:23
  • @RonMaupin How to fix this? how it can be possible that one ip address can be in double macaddress ? its related to this im on vmware ? maybe something wrong in my arospoof ? but how it can be possible ?!
    – Antonio
    Oct 29, 2015 at 15:26
  • What exactly were you trying to do? It seems you're spoofing the address, so it's normal that both (the real device, and the spoofing device) andswer the arp request.
    – mulaz
    Oct 29, 2015 at 15:28
  • @mulaz Is it normal when i open arp -a on the victim machine and its said that one ip address have two mac address ?
    – Antonio
    Oct 29, 2015 at 15:29
  • You need to edit your question to be specific: state what you think is wrong, what you have done to try to correct the problem, and ask a specific question.
    – Ron Maupin
    Oct 29, 2015 at 15:30

2 Answers 2


ARP spoofing is just the thing that is doing the multiple MAC's for one IP. :) So if you want to avoid duplicate adresses... stop ARP spoofing (poisoning) your network.

If you want to understand this, read the following page:



This is the sort of thing that happens when you break a network by hacking it, and it is perfectly normal behavior. You can also get this result if you assign the same IP address to two different hosts, which is basically what you did when you spoofed ARP.

This is an attack on the network; bad guys do this sort of thing to disrupt a network. Doing this sort of thing on a network belonging to someone else can get you in a lot of trouble. It's OK to do this on your own network if you want to see what happens, and you saw the results (not good).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.