How to arp spoof specfic targets
Author: um3ha4aCreated Oct 10, 2019Updated Jul 29, 2025
Environment
Please provide:
- Bettercap version you are using (
bettercap -version).bettercap v2.24.1 (built for linux amd64 with go1.11.6) [type 'help' for a list of commands] - OS version and architecture you are using.
kali - Go version if building from sources.
- Command line arguments you are using.
bettercap -caplet beef-active.cap -eval "set arp.spoof.targets 172.16.56.144,172.16.56.150;" - Caplet code you are using or the interactive session commands.
set http.proxy.script /usr/share/bettercap/caplets/beef_inject.js
http.proxy on
set arp.spoof.whitelist 172.16.56.1-143,172.16.56.145-149,172.16.56.151-254
set arp.spoof.internal true
sleep 1
arp.spoof onSteps to Reproduce
- First Step
- Second Step
- and so on...
I want to arp spoof between A(172.16.56.144) and B(172.16.56.150), so in A's arp cache I can see B is my kali's mac address, and any other hosts' mac address is original, in ettercap the command is:
ettercap -i eth0 -Tq -M arp:remote /172.16.56.144// /172.16.56.150//
In bettercap I don't know how to achieve this, the default command make me spoof the gateway, and I read bettercap docs, try to use whitelist to only spoof 144 and 150, but when bettercap is running, I still see every hosts' arp is my kali's arp
Source: bettercap/bettercap