Does Ettercap exploit the Hole196 vulnerability?

Question

If not, how is an ARP attack possible on a WPA2 secured network?

Answer 1

ARP poisoning is basically when you declare your MAC address is responsible for an IP address, I think usually the router. So you receive all the victims packets in a "man in the middle" type attack. I read that WPA2 encryption happens at a layer below that of packet routing.

Google is your friend, there was already a post regarding this on here: Is WPA2 WiFi protected against ARP poisoning and sniffing?

Also read this: http://community.arubanetworks.com/t5/Community-Tribal-Knowledge-Base/Analysis-of-quot-Hole-196-quot-WPA2-Attack/ta-p/25382 it explains why exploiting the Hole 196 vulnerability is not required to ARP spoof on a WPA/WPA2 protected network.