I am testing two differents lan and I am tring to sniff traffic with Mitm attack using simple Linux shell command like arpspoof and whireshark to sniff the packets. In the first lan I can sniff without problem while in the second lan, using the same techniques, in whireshark I can see that is detected the use of the same ip for two differents MAC and I cannot see http protocol layer packets. Why in the first lan there are no duplicated ip? I thought maybe the switch arp table contains more than one entry with the same ip instead of containing only the modified row.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 15, 2017 at 5:30

1 Answer 1


Switches don't have ARP tables, nor do they care about IP addresses. A switch will have a MAC address table that has a MAC address and the switch interface where the MAC address came in as the source MAC address.

The switch MAC address table contains a single entry for each MAC address. When you spoof a MAC address, it messes with the switch MAC address table, causing the interface for the MAC address entry in the table to keep changing.

MAC address spoofing is really about network disruption, rather than information theft. Multiple hosts claiming the same MAC address will cause the switch MAC address table to constantly change; some frames will go to one host, and some frames to another host.

When you use ARP spoofing, you are really spoofing the ARP cache in a host. The host with an incorrect MAC address for an IP address will send traffic for that IP address to that MAC address, and no other. This only works on a single LAN. If you are doing this across LANs, then you have a different problem: MAC addresses are only valid on the LAN where they exist, and any traffic destined for a different LAN gets sent to the MAC address of the host's configured gateway. You could spoof that, but then nothing from any host with the spoofed gateway MAC address will ever get off the LAN to another LAN.

  • Thanks. The two network I am working on are completely separated. It is just an example to say that arp spoofing one one works fine and there is no duplicated ip while in the other there is duplicated ip and I cannot sniff http layer. Maybe the problem is this duplicated ip. For example I have the gateway IP used by the real gateway MAC and the attacker MAC. Is it normal I think . . . ? Commented Nov 24, 2016 at 9:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.