What is an ARP Spoofing attack?

an ARP Spoofing attack is where the attacking computer pretends to be another computer and tricks the router into sending traffic to attackers computer rather than its orignal destination. However more than that most ARP Spoofing attacks will even continue to forward packets from the attacking machine to the victim in order to have everything on the victims end appear normal, this can occur without the victims knoledge. All the attack essentially needs is the local IP address of the victim and they can perform this attack.

Prerequisites

I feel obligated to say that this is not recommended to run against a network you do not own and you should not perform this attack on people. This guide is merely to demonstrate how one could perform this attack without actually attempting to cause harm. There would need to be many steps taken after this attack in order to actually do anything harmful. Since most sites are encrypted with HTTPS and most data flowing over the wire will be encrypted, simply being able to read network traffic doesn’t do that much for a hacker in 2025. However this is still an invasion of pricy if you run this against people who are unaware you are doing so and can be considered illegal to run against people who you do not have the express permission to do so against.

How to get set up

The first thing you will need to demonstrate this attack will be your attacking machine. I recommend something Linux based however it could be any machine capable of running the ettercap-gui software. Ettecap is a tool used to perform this attack and is capable of ARP spoofing as well as many more options. However step 1 will be to install ettercap on your attacking machine. If you are using Kali it should be pre-installed, or if you are using an Arch based Distro there are some extra steps that need to be taken in order to allow ettercap to have access to your Network Interface Card (NIC). These are the steps to be taken on Arch Distros

Shell
sudo pacman -S ettercap

then run this to create the ettercap group

Shell
sudo groupadd ettercap

next add yourself to this group

Shell
sudo usermod -aG ettercap $USER

then setup the correct capabilities to allow ettercap access to the needed system resources

Shell
sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/ettercap

finally, refresh your session in order to take effect by running

Code
newgrp ettercap

Now you should be able to run ettercap -G to start ettercap in the graphical user interface mode or GUI mode. If this did not work for you please consult the documentation on the Arch Wiki or whatever other distro you chose to use.

Next we will need to setup Wireshark in order to verify our ARP Spoofing attack is working as intedned and read network traffic. Again on Arch there are some additonal hoops to jump through but the commands are as follow

first, install the qt version of Wireshark to see the GUI

Shell
sudo pacman -S wireshark-qt

Next we need to create the Wireshark group like we did for ettercap

Shell
sudo groupadd wireshark

Now that the group is created, addd yourself to that group by running

Shell
sudo usermod -aG wireshark $USER

Now this is where things get a little more complicated when it comes to Wireshark on Arch. Arch needs special permissions to read the pcap information coming from your system so you can do that by copy and pasting these commands, don’t ask me exactly what they do but it fixes the problems so don’t ask questions, ask Claude

Shell
sudo chgrp wireshark /usr/bin/dumpcap
sudo chmod 750 /usr/bin/dumpcap
sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap

Now refresh your session with

Code
newgrp wireshark

now try running wireshark and see if you see your NIC appear as an option to read traffic from.

Performing the attack

Now on to the fun part, actualy runnning the attack
Step 1 is to opening ettercap -G
Step 2 is to start scanning for hosts, you will need to find the IP you want to spoof, it is not needed but I recommend using a tool like ‘Angry IP Scanner’ if you don’t know what IP the device is on, however I will not be providing detailed instructions on how to use that Tool as it is technically not needed as you can also accomplish this just using ettercap

Step 3 Now you should set your target IP to Target 1 in ettercap and your defualt gateway IP as Target 2 in ettecap

Step 4 click on the globe icon, then click on ARP poisoning

This will initialize the attack and begin to spoof

Step 5 Now that we are ARP spoofing, we want to see the traffic being spoofed. To do this we will use a tool called Wireshark, open wireshark by opening a terminal and typing ‘wireshark’ then at the top you will want to filter the traffic to just see your target IP and its traffic by adding ‘ip.addr == 10.1.9.32’ at the top of wireshark. This will now only show you the spoofed traffic

Conclusion

By doing these steps it demonstrates how to hijack network traffic and point traffic not meant for you to your machine. From here you could attempt to phish your victim onto a HTTP site and get them to enter credentials and in wireshark you can read that in plain text. The possibilities are endless from here but this is just a small part of what it would actually take ot compromise somebody. This does not allow access to someones machine but merely the internet traffic they send out or receive. It is now up to you to make your next move in compromising your victim and achieving whatever you want out of this. I hope you learned something and remember to only use this against people you have the explicit permission to hack