I am testing two differents lan and I am tring to sniff traffic with Mitm attack using simple Linux shell command like arpspoof and whireshark to sniff the packets. In the first lan I can sniff without problem while in the second lan, using the same techniques, in whireshark I can see that is detected the use of the same ip for two differents MAC and I cannot see http protocol layer packets. Why in the first lan there are no duplicated ip? I thought maybe the switch arp table contains more than one entry with the same ip instead of containing only the modified row.
Switches don't have ARP tables, nor do they care about IP addresses. A switch will have a MAC address table that has a MAC address and the switch interface where the MAC address came in as the source MAC address.
The switch MAC address table contains a single entry for each MAC address. When you spoof a MAC address, it messes with the switch MAC address table, causing the interface for the MAC address entry in the table to keep changing.
MAC address spoofing is really about network disruption, rather than information theft. Multiple hosts claiming the same MAC address will cause the switch MAC address table to constantly change; some frames will go to one host, and some frames to another host.
When you use ARP spoofing, you are really spoofing the ARP cache in a host. The host with an incorrect MAC address for an IP address will send traffic for that IP address to that MAC address, and no other. This only works on a single LAN. If you are doing this across LANs, then you have a different problem: MAC addresses are only valid on the LAN where they exist, and any traffic destined for a different LAN gets sent to the MAC address of the host's configured gateway. You could spoof that, but then nothing from any host with the spoofed gateway MAC address will ever get off the LAN to another LAN.