This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

arp poisoning pcap

0

This pcap link shows an interesting example on how arp poisoning is done (starting from packet 54). My question is, isn't packet 56 enough to achieve the effect of arp poisoning?

asked 09 May '15, 08:01

pktUser1001's gravatar image

pktUser1001
201495054
accept rate: 12%


One Answer:

0

The arp request will update the arp cache of the victim. Unsolicited arp replies will usually be ignored.

answered 09 May '15, 10:33

Roland's gravatar image

Roland
7642415
accept rate: 13%

Packet 54 is the request and 55 is the reply. packet 56 a reply for which request? Thanks.

(10 May '15, 06:57) pktUser1001

Packet 56 is an unsolicited reply, there is no request for it.

(10 May '15, 07:28) Roland