ARPSPOOF(8)

📦
version 2.5a2 · 2 versions
  • 2.5a2 · arch rolling, debian bookworm, debian trixie, nixos 26.05, nixpkgs unstable, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking (latest)
  • 2.4 · epel 9, fedora 43, fedora 44
, in arch rolling, debian bookworm, debian trixie, nixos 26.05, nixpkgs unstable, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 ARPSPOOF(8) 💖

okay bestie, welcome to the arpspoof page — it's section 8 of the System Manager's Manual, so it's a big-girl admin tool, not some cute little userland toy. let's get into it 🎀

✨ NAME ✨

arpspoof — intercept packets on a switched LAN

like. that's the whole vibe. it snatches packets. on a switch. iconic 💅

🦋 SYNOPSIS 🦋

arpspoof [-i interface] [-c own|host|both] [-t target] [-r] host

🌸 DESCRIPTION 🌸

so here's the tea, bestie. arpspoof redirects packets from a target host (or, like, all the hosts) on the LAN — packets that were meant for another host on the LAN — by forging ARP replies. that's it. that's the trick. it lies to the network about who owns which hardware address and everyone just… believes it. 😭

and the way that this is an extremely effective way of sniffing traffic on a switch?? not me being obsessed with how well this works. switches think they're soooo secure. no. 💀

⚠️ okay but listen — Kernel IP forwarding (or a userland program that does the same thing, like fragrouter(8)) has to be turned on ahead of time. like, before you run this. do not skip this step. it's giving "i forgot the pre-req" and that's a whole tragedy.

💜 OPTIONS 💜

  • -i interface — pick the interface you wanna use. that's the one it rides on. 🛣️
  • -c own|host|both — this one specifies which hardware address to use when it's restoring the arp configuration. while it's cleaning up, packets can be sent with the own address and also with the address of the host. and here's the caveat bestie, listen close: sending packets with a fake hw address can disrupt connectivity with certain switch/ap/bridge configurations. however — it works more reliably than using the own address, which is the default way arpspoof cleans up afterwards. so like, tradeoffs. pick your poison. 🙈
  • -t target — specify a particular host to ARP poison. if you don't specify one, it goes for all hosts on the LAN. and you can repeat this option to specify multiple hosts — stack 'em up, bestie. 🫶
  • -r — poison both hosts (the host and the target) so you capture traffic going in both directions. 🦋 and important: this is only valid in conjunction with -t. no -t, no -r. periodt.
  • host — specify the host you wish to intercept packets for. usually this is your local gateway. 👑

🌈 SEE ALSO 🌈

dsniff(8), fragrouter(8)

go read those too, they're the friend group 🫶

👑 AUTHOR 👑

Dug Song <dugsong@monkey.org>

king behavior, honestly. 💜

and that's the whole page bestie!! this was ARPSPOOF(8) from the System Manager's Manual — section 8, admin hours only — and it lives on the last line of the original page right there with its name. go forth, forward those packets, and don't forget to turn on IP forwarding first or i will literally cry. ✨🎀💖

📦 where this page comes from