Hi All,

I am trying to learn arpspoof to sniff packets from our Test network . My intentions are honest and I am doing this exercise only for learning purpose .

I have installed dsniff 2.3 on a Linux Machine. The installation was done successfully .
I am using libnids-1.18 and ibnet-1.0.2a. . These are old versions because the installation of dsniff fails with the latest version of libnids and libnet.

After that I did ARP spoofing so that all traffic from 192.168.16.25 (victim ) is redirected to the attacker machine ( 192.168.16.251 ) . This was done using the following command

arpspoof -t 192.168.16.25(victim) 192.168.1.254 (Gateway )

I have enabled ip_forwarding on the attacker machine.

Then I tried to sniff username and passwords from the attacker machine
using the following command.

dsniff -i eth0 -n -c

But dsniff was not able to sniff any username and password. Although there was traffic from the victim machine as the user (on victim machine) tried to login to a remote site using plain text.

Please guide me where I went wrong .

With Thanks in Advance.

regards

Verify you are really seeing the packets by using tcpdump.

Some (smarter more expensive) switches are smart enough to prohibit the old arp spoofing techniques. You might not be able to do it.

I tried the same thing with Windows based Password Sniffer tools and I was able to sniff packets. So , the switch is not smart enough to prevent ARP spoofing.

So , it seems the problem lies with dsniff only..........