I am conducting ARP spoofing experiments using virtualBox. I am using bridge mode and the network topology is shown in the following figure. Firstly, delete the ARP cache of virtual machine A in virtual machine B, then ping the IP address of virtual machine A. Use the wireshark tool to capture the ARP response sent by virtual machine A to B. Then, on the host computer (Windows), modify the response packet by changing the source MAC address to the host computer's MAC address, Keep the source IP as the IP of virtual machine A. Then delete the ARP cache of virtual machine A again in virtual machine B, and ping the IP address of this virtual machine A. At this time, use the sending tool to send out the ARP spoofing packet. It is reasonable for virtual machine B to receive the spoofing packet, but using wireshark to catch the packet under virtual machine B cannot catch the spoofing packet, which is very strange; enter image description here
Then I tried another experiment and exchanged identities this time. Virtual machine A acted as the deceiver and the host (Windows) acted as the deceiver. I found that this spoofing packet could be caught under virtual machine B. I want to know what happened. Is it related to the virtualBox bridging network itself? (By the way, my firewall has been completely closed, so it won't be a problem with the firewall)