{"action":"closed","issue":{"url":"https://api.github.com/repos/bettercap/bettercap/issues/95","repository_url":"https://api.github.com/repos/bettercap/bettercap","labels_url":"https://api.github.com/repos/bettercap/bettercap/issues/95/labels{/name}","comments_url":"https://api.github.com/repos/bettercap/bettercap/issues/95/comments","events_url":"https://api.github.com/repos/bettercap/bettercap/issues/95/events","html_url":"https://github.com/bettercap/bettercap/issues/95","id":300661177,"number":95,"title":"Device is shown multiple times with wrong mac address when arp.spoof is on and pc running bettercap lose connection","user":{"login":"tonjo","id":4726289,"avatar_url":"https://avatars0.githubusercontent.com/u/4726289?v=4","gravatar_id":"","url":"https://api.github.com/users/tonjo","html_url":"https://github.com/tonjo","followers_url":"https://api.github.com/users/tonjo/followers","following_url":"https://api.github.com/users/tonjo/following{/other_user}","gists_url":"https://api.github.com/users/tonjo/gists{/gist_id}","starred_url":"https://api.github.com/users/tonjo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tonjo/subscriptions","organizations_url":"https://api.github.com/users/tonjo/orgs","repos_url":"https://api.github.com/users/tonjo/repos","events_url":"https://api.github.com/users/tonjo/events{/privacy}","received_events_url":"https://api.github.com/users/tonjo/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-02-27T14:52:33Z","updated_at":"2018-02-27T18:54:53Z","closed_at":"2018-02-27T18:54:53Z","author_association":"NONE","body":"### Description\r\nDuring arp spoofing, some endpoints are shown twice, with wrong mac address.\r\nAfter stop spoofing, pc running bettercap is isolated from lan.\r\n\r\nFull debug:\r\n[betterbug.txt](https://github.com/bettercap/bettercap/files/1763316/betterbug.txt)\r\n\r\n### Environment\r\n* OS version: Ubuntu 16.04, kernel 4.13.0-36-generic\r\n* bettercap version: from `go get ...` Tuesday 27 at 14:20 Italian time\r\n\r\n### Steps to Reproduce\r\n1. net.show\r\n2. arp.spoof on\r\n3. ping some device from pc running bettercap in net.show list\r\n4. net.show (showing duplicate)\r\n5. arp.spoof off\r\n6. From shell: `ping <gateway>`: no answer \r\n\r\n**Expected behavior:**\r\nDevice already discovered should not appear again with another mac address.\r\nPC should not lose connection after spoofing.\r\n\r\n**Actual behavior:**\r\nOld device with new mac address (pinging from pc running bettercap, it will have pc's mac address).\r\nPC lose connection.\r\n\r\nNOTE:\r\n- **Full debug show an example with arp.spoof.targets set to one device, but is not necessary, \r\nissue is present even if spoofing entire lan**\r\n- `ping` is just a way for generating traffic from pc to device, same thing happens when doing some activity from the device involving the pc (browse samba shares for example).\r\n- After stop spoofing, arp cache of PC is intact:\r\n    $ arp -an\r\n    ? (192.168.1.1) at MAC_ADDRESS_GATEW [ether] on enp0s25\r\n    ? (192.168.1.8) at MAC_ADDRESS_PHONE [ether] on enp0s25\r\n"}}
{"actor":{"display_login":"evilsocket"}}