Arpspoof

Arpspoof is part of the Dsniff suite of tools. It's used for ARP Poisoning (see Man in the Middle/Wired and Man in the Middle/Wired/ARP Poisoning).

ARP Poisoning with Arpspoof

Here's a quick blow-by-blow for setting up ARP poisoning with arpspoof.

Forward Packets, Don't Drop Them

By default, packets sent to a computer that aren't meant for that computer are dropped. However, since we're running a man-in-the-middle,all of our traffic will be someone else's. So tell Linux to forward packets that aren't for us:

$ echo 1 > /proc/sys/net/ipv4/ip_forward

At any point you can confirm that packets are being forwarded by running:

$ cat /proc/sys/net/ipv4/ip_forward
1

Spoofing

You'll need a terminal window for each target you're spoofing. For a simple man-in-the-middle, that's two terminal windows: one for the gateway and one for the sheep.

Spoof the Gateway

Open the first terminal window. Assuming your network interface is eth0, your gateway is at 10.0.0.1, and your sheep is at 10.0.0.75:

$ arpspoof -i <network device> -t <target ip> <source ip>

$ arpspoof -i eth0 -t 10.0.0.1 10.0.0.75

Spoof the Sheep

Open the second terminal window and spoof the sheep. This assumes the gateway is at 10.0.0.1 and the sheep is at 10.0.0.75:

$ arpspoof -i <network device> -t <sheep ip>

$ arpspoof -i eth0 -t 10.0.0.75 10.0.0.1

Sit Back And Watch The Show

You're now performing a Man in the Middle on eth0, so you can open a Wireshark instance and sniff traffic on that device.

Wireshark Dump

Let's take a look through some of the Wireshark dump to see what we can see.

First, lots of DNS queries, giving away all the websites being visited, regardless of whether we're using HTTPS or not:

Caveats

Duplicate IP Warning

When you see the Wireshark dump, you'll see your old friend, the Duplicate IP Warning packet, giving you away to anyone sniffing traffic on the network:

You are sending duplicate packets

Note that if you set packet forwarding ON, your computer will essentially be duplicating all traffic to a particular target, which is yet another dead giveaway that there's an ARP poison attack going on on the network (even visually, as every time the Sheep initiates any traffic there will be a big patch of black packets).

However, if you turn packet forwarding OFF, your Sheep will not receive any traffic destined for it, and the Sheep's network will not work.

More Caveats

You should note that this is subject to the same drawbacks mentioned on Man in the Middle/Wired/ARP Poisoning with Ettercap - that is, that the Sheep will start seeing funny certificate behavior, the network admin will start seeing duplicate IP addresses and false certificate packets, and in general you will generate lots of suspicious traffic.

Even More Caveats

In addition, the frequency of ARP packets from arpspoof is 1 Hz - one packet every second - and if another computer connects to the gateway and asks for other devices' MAC addresses, the gateway will send out a query for every IP address asking "Who is 10.0.0.75?" - and your target Sheep will hear that and respond. This will break your man-in-the-middle until the next ARP packet is sent out.