root@dco:~$ Wireshark
#step 1: get an overview
WireShark
Filter: arp.duplicate-address-detected or arp.duplicate-address-frame
ARP FLOODING
root@dco:~$ Wireshark
#step 1: get an overview
WireShark
Filter: ((arp) && (arp.opcode == 1)) && (arp.src.hw_mac == target-mac-address)
MITM
root@dco:~$ Wireshark
#step 1: get an overview
WireShark
Filter: http
* the image below is specific to an HTTP MitM attack
- source & destination mac addresses were added as columns to detect this MitM
