Here's the setup:

Host A :
Host B :
Host C :

All connected via switch.

I want to monitor traffic between A and B by setting a route on A and B to use C as their GW for each other.

I can get this to work fine if A and B are on different subnets, but was hoping there would be a way to do it with all on the same subnet.

S0 first I setup routes on both A and B by issuing

route add -host B gw C

(and vice versa for B)

On C i enable forwarding. When i run wireshark on C, and then ping from A to B, I see the ping request come in from A, with A's MAC sent to C's MAC. then C retransmits using C's MAC to B's MAC.

A and B both have 'accept_redirects' off so that they are forced to use C.

Problem: pinging from A to B never works. Wireshark on B never shows an incoming ping request.

Wireshark on C shows its being sent to B's ip/mac, but it looks like B never gets it, or its being filtered out somewhere below wireshark.

any hints? what could be filtering out the packet?

  • Proxy ARP. Or Ettercap to implement ARP poisoning. Best option is to mirror the switch ports for A and B to C, but that isn't usually a feature on consumer grade networks. – roaima Jan 20 at 16:50
  • Dont think proxy_arp will make a difference since A and B already know to send their packets to C. C is forwarding them (according to Wireshark), but the receiving end does not show their receipt in wireshark. – patrick h Jan 20 at 17:49
  • Currently, can B ping C? – A.B Jan 20 at 20:30
  • Yes, both A and B can ping C, and C and ping both. I'm wondering if there is some filtering happening down under somewhere in B ???? Firewalld is disabled. Rp_filter off (but shouldn't be an issue here anyway I don't think) – patrick h Jan 20 at 20:37

Try arpspoof from the dsniff package.

It won't work if the two hosts can protect against ARP Poisoning since this is exactly how it works.

Shell 1

# Enable packet forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# Tell A we are B
arpspoof -t hostA hostB

Shell 2

# Tell B we are A
arpspoof -t hostB hostA

Shell 3

# Watch the traffic
tshark -f 'host hostA and host hostB and not arp'
  • Not sure about this fix in my situation, because my routing box already sees the ping from A-to-B and forwards it to B's MAC, and vice verse. The problem is wireshark on B never shows receipt of the request from A (even tho wireshark on router shows forwarding to B's mac) – patrick h Jan 20 at 18:49
  • You said there is no routing, so the device is acting as a switch, and therefore susceptible to ARP spoofing per this solution. Without this your Host C won't see anything - that's exactly what switches are supposed to do. – roaima Jan 20 at 22:32
  • There is an explicit static route on A and B to each other via C. – patrick h Jan 21 at 15:35
  • That is completely contradictory to the information provided in your question, where it says, "Host A: / Host B: / Host C:". Which is correct? – roaima Jan 21 at 16:14
  • I'm sorry, I think you might have missed this part, "S0 first I setup routes on both A and B by issuing route add -host B gw C (and vice versa for B)" – patrick h Jan 21 at 21:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.