So for context I have two virtual machines one is running on kali linux which is the "Hacker's" machine and the other one is running on windows 10 pro which is supposed to be the victim's machine

So today I tried doing arp spoofing/poisoning via Bettercap and when start the spoofing it works and it actually changes the mac address of the router on my windows machine however whenever I start the process I lose connection to the Internet on my windows virtual machine and a yellow icon appears next to my ethernet icon

and when I try to "Troubleshoot" the problem it outputs Problems found: Windows can't communicate with the device or resource (primary DNS server)

But however I know that the problem isn't caused of the windows machine because as soon as I turn off the spoofing it reconnects just fine

So please help me and tell me what is causing this problem I think that it is from the router's settings itself that they have built a mechanism to prevent arp spoofing or can it be a problem with my kali Linux machine's port forwarding if so can you tell me how to update the port forwarding settings Appreciate it!

P.S. : I have tried turning on port forwarding by writing echo 1 > blah blah blah into the terminal and that didn't solve the issue

2 Answers 2


The machines use the router to get to internet. So if you spoof the router's address, and don't also pretend to be a router, you lose connectivity.

Turning on port forwarding isn't enough, because you are setting up an abnormal condition that default settings are not designed to handle.

  • I know that thats why I typed set arp.spoof.fullduplex true which tells the router that i am the victim and tells the victim that im the router and that didnt work Jan 29 at 16:22

Your router may have security measures in place to detect and prevent ARP spoofing attacks.

Find your routers specifications and rule this out.

Not the answer you're looking for? Browse other questions tagged or ask your own question.