when using arpspoof to intercept client traffic?
Make sure you are actually forwarding the intercepted packets, either via kernel IP forwarding or with fragrouter. If you are indeed seeing the client’s half of the TCP connection (e.g. as verified using tcpdump), make sure you’ve enable dsniff’s half-duplex TCP stream reassembly (dsniff -c). The *snarf tools do not yet support this mode of operation.