Even though the attack is launched by VM1 (left) the ARP entry for the gateway in the ARP table of VM2 (right) remains intact because it is static.