I have also noted that since I started the obviously unsuccessful attacks, the number of IPs that pop upon self 'arp -a' request have gone down. Does this affect my ability to ARP poison, meaning I can only poison IPs which appear on my arp -a request? Is this an ordinary behavior or may it suggest my clumsy 'promisc' ARP requests to the gateway made the administrator become aware of me as the attacker and is somehow attempting to hinder my ability to poison? If the latter is true, is there some way to override him, maybe changing my mitm choice?