Arpspoof

Arpspoof is part of the Dsniff suite of tools. It's used for ARP Poisoning (see Man in the Middle/Wired and Man in the Middle/Wired/ARP Poisoning).

ARP Poisoning with Arpspoof

Here's a quick blow-by-blow for setting up ARP poisoning with arpspoof.

Forward Packets, Don't Drop Them

By default, packets sent to a computer that aren't meant for that computer are dropped. However, since we're running a man-in-the-middle,all of our traffic will be someone else's. So tell Linux to forward packets that aren't for us:

$ echo 1 > /proc/sys/net/ipv4/ip_forward

At any point you can confirm that packets are being forwarded by running:

$ cat /proc/sys/net/ipv4/ip_forward
1

Spoofing

You'll need a terminal window for each target you're spoofing. For a simple man-in-the-middle, that's two terminal windows: one for the gateway and one for the sheep.

Spoof the Gateway

Open the first terminal window. Assuming your network interface is eth0, your gateway is at 10.0.0.1, and your sheep is at 10.0.0.75:

$ arpspoof -i <network device> -t <target ip> <source ip>

$ arpspoof -i eth0 -t 10.0.0.1 10.0.0.75

Spoof the Sheep

Open the second terminal window and spoof the sheep. This assumes the gateway is at 10.0.0.1 and the sheep is at 10.0.0.75:

$ arpspoof -i <network device> -t <sheep ip>

$ arpspoof -i eth0 -t 10.0.0.75 10.0.0.1

Sit Back And Watch The Show

You're now performing a Man in the Middle on eth0, so you can open a Wireshark instance and sniff traffic.

Wireshark Dump

When you see the Wireshark dump, you'll see your old friend, the Duplicate IP Warning packet, giving you away to anyone sniffing traffic on the network:

Drawbacks

You should note that this is subject to the same drawbacks mentioned on Man in the Middle/Wired/ARP Poisoning with Ettercap - that is, that the Sheep will start seeing funny certificate behavior, the network admin will start seeing duplicate IP addresses and false certificate packets, and in general you will generate lots of suspicious traffic.

In addition, the frequency of ARP packets from arpspoof is 1 Hz - one packet every second - and if another computer connects to the gateway and asks for other devices' MAC addresses, the gateway will send out a query for every IP address asking "Who is 10.0.0.75?" - and your target Sheep will hear that and respond. This will break your man-in-the-middle until the next ARP packet is sent out.