Problems with ARP Spoofing =/

[melvinkoopmans]

Hello,

I'm running Backtrack 5 on in an VM (VMware Workstation) and I am getting troubles when I try to do a arpspoof on our LAN Network (not an other VM).
Doing this I'm getting this error:

arpspoof: couldn't arp for host 192.168.123.254

The LAN Computer's Network Address is: 192.168.123.102

Im doing to following things for ARP Spoofing:

cat /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/ip_forward
cat /proc/sys/net/ipv4/ip_forward

screen
arpspoof -t 192.168.42.254 192.168.123.102
CTRL+a S (Split)
CTRL+a TAB (Jumping to next display region)
CTRL+a C (Create the session in region)
arpspoof -t 192.168.42.102 192.168.123.254

The first one giving me an result, but the second one (arpspoof -t 192.168.123.102 192.168.42.254) gives the error I gave above.

My ifconfig looks like this:

eth1      Link encap:Ethernet  HWaddr 00:0c:29:27:8d:30  
          inet addr:192.168.42.135  Bcast:192.168.42.255  Mask:255.255.255.0
          inet6 addr: fe80::20c:29ff:fe27:8d30/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1446 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2823 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:89969 (89.9 KB)  TX bytes:148952 (148.9 KB)
          Interrupt:19 Base address:0x2024

If anyone could help me, I would really apriciate that
If any more information is needed, tell me

Regards,
Melvin Koopmans

[waterways]

Just a guess (I am no expert lol) but I would try using bridged mode in VMware. Go to virtual machine settings, click on the network adapter, and the option is there.. Good luck I hope it works!

[kaxen]

i think you should run "arpspoof -t 192.168.42.102 192.168.123.254 eth1". correct me if i am wrong.

[sickness]

arpspoof -i eth1 -t 192.168.42.102 192.168.123.254

Try this.

[atticus]

i have the exact same problem. Would like to get an answer here

[paraziit]

But vmware doesn't allow systems to use their interfaces in forensic mode to listen on network traffic, can anyone help us how to solve this prob, i'm using ettercap to sniff on LAN

[gunrunr]

are the host and gateway in thesame subnet, seems to me like they aren't, then again you aren't listing the subnet masks. Correct me if i'm wrong but I don't think you can arpspoof an address in an non-contiguous network.