I’m working on a cybersecurity lab with three virtual machines and I’ve run into an issue with ARP spoofing. Here’s the setup:

• Machine A (Domain Controller): Windows Server 2022, IP: 10.0.1.128
• Machine B (Client): Windows 10, IP: 10.0.1.129 Machine C (Attacker):
• Kali Linux, IP: 10.0.1.3

I am using arpspoof on Kali Linux to perform ARP spoofing. The command I use is:

arpspoof -i eth0 10.0.1.129

I am intercepting traffic between Machine A and Machine B. Specifically, I’m capturing Kerberos traffic (AS REQ and AS REP) where the source and destination IPs are 10.0.1.128 and 10.0.1.129.

Despite capturing this traffic, Machine B is still able to communicate with Machine A. I have verified that IP forwarding is disabled on Kali Linux by checking /proc/sys/net/ipv4/ip_forward, which is set to 0.

Is there a reason why Machine B can still communicate with Machine A despite the ARP spoofing?

Any insights or troubleshooting tips would be greatly appreciated!