Hey everyone, and welcome to WhiteHatLabs! 💻🛡️ I started this community to share research, discuss offensive security tactics, and release the custom tools we build. Today, I'm open-sourcing our first project: ArpSpector. It's an enterprise-grade ARP Poisoning and MITM framework designed to overcome the limitations of typical academic scripts and perform reliably in real-world corporate networks. 🔥 Core Technical Features: Extreme Efficiency (L2Sockets): Instead of opening and destroying a socket for every single packet (which throttles your CPU), ArpSpector instantiates persistent Layer 2 sockets. You can run this seamlessly on a Raspberry Pi without breaking a sweat. Bulletproof DNS Spoofing (Anti-Race Condition): Instead of trying to outrun the target's real DNS server, the framework dynamically interacts with your Linux iptables to trap and drop the forwarded requests. Your spoofed response wins 100% of the time. Stealth Mode (Adaptive Jitter): It passively monitors the target's traffic rate and dynamically adjusts the injection intervals with randomized delay jitter to evade threshold-based IDS/IPS detections. Thread-Safe PCAP Capture: Captures real-time evidence by writing directly to disk using sync=False and robust threading locks. This prevents RAM leaks and dropped packets in high-traffic MITM scenarios. Surgical Restoration: Upon exit, it cleans up the network using Directed Unicast Gratuitous ARP rather than aggressive broadcasts, avoiding security alerts on enterprise switches (like Dynamic ARP Inspection). 📂 Repository & Documentation: The project is released under the AGPL v3.0 license. You can check out the source code, installation docs, and usage examples here: 👉 https://github.com/whitehatlabs000/arpspector ⚠️ Disclaimer: This tool is strictly for educational purposes, authorized adversary simulations, and approved Red Team infrastructure. I invite you all to clone it, spin it up in your labs, and let me know your thoughts! Feel free to open Pull Requests or drop a comment below on what you think about the iptables approach for dominating DNS Spoofing