ARP poisoning (spoofing) with ASUS-Merlin

[jadog]

Is it possible to allow ARP poisoning (spoofing) with this firmware? I'm using a connected device that requires this to be allowed and it is not functioning properly. I was told that the device relies on ARP poisoning, just like the Disney Circle does.

If it is possible, can someone direct me on how to change this setting?

 

[ColinTaylor]

Router model?
Firmware version?

There is no setting to change. As far as I am aware there is nothing on the router that would deliberately prevent ARP spoofing.

 

[jadog]

RT-AC88U is the model I have. The latest firmware - 384.15. I wonder why I am having issues with it then. Interesting.

 

[Maverickcdn]

Ive been learning more about the ARP table on these ASUS units.

You can try disconnecting your device... run in an SSH console

ip link set arp off dev br0 ; ip link set arp on dev br0

To flush the cache immediately

Spoof your MAC and reconnect and see where you get. Then you can use arp -a or arp -n to see if the ARP table has your spoofed MAC-->IP Address.

 

[Maverickcdn]

Reading more about those types of devices Id read the owners manual of it as well and see if theres something else you need to do on initial setup you may have overlooked/forgotten about

It looks as though they spoof the Router MAC and capture all traffic so you may even have to disconnect ALL devices, flush the arp cache/table with the code above or do a config reset... and then plug in the monitoring device first, test it spoofed the router MAC to the monitoring device IP address if you want and then plug in/connect the rest of your clients. Just spit ball'n...

But it does look as though (for the Disney Circle anyway) they have a router compatibility list so there are routers that arent compatible or require a special config

 

[jadog]

Thank you. That was very helpful!