Poisoning the ARP table entries of a device and then forwarding them through your machine is one unethical way of capturing the traffic from the target machine.
Let's say, for example, we have the default gateway at IP 192.168.1.1 and one client machine configured at IP 192.168.1.2. Both of these devices are maintaining local ARP cache entries. That enables them to send packets over the LAN. Now, the Wireshark (use arpspoof or ettercap to poison the ARP entries) machine at IP 192.168.1.3 will poison the ARP cache entries by flooding the client and gateway machine with multiple ARP packets, stating to the client PC that the default gateway has been changed to IP 192.168.1.3 and stating the gateway that the client is now at IP ...
