The concept behind this is simple. ARP is the protocol that maintains network devices tables up-to-date by associating an IP address with a MAC address. The problem with ARP is that it doesn’t really care about who answered, it will gladly update the tables from whoever says so. Most of the time, it won’t even ask. So the idea behind the attack, is to send the client an ARP answer saying “hey, I’m the gateway, send stuff to me” and a second ARP answer to the real gateway saying “hey there, I’m this guy, send me his stuff”. Then you just have to relay the packets between the victim and the gateway.Those schemas are more simply to understand
In Linux, the rerouting can be done using the following iptables commands:
iptables -t nat -A PREROUTING -i -p tcp –dport -j REDIRECT –to-port
iptables -t nat -D PREROUTING -i -p tcp –dport -j REDIRECT –to-port
