Detect someone on network mitm?

Using kali, is there a way to detect someone on network doing a mitm attack?

The most common technique for MITM is to use ARP poisoning. To learn about the process, put a promiscuous sniffer on to your LAN and use a tool such as arpspoof or ettercap to do the MITM; and a tool like wireshark to monitor the packets. IDS type tools such as SNORT are capable of automatically spotting these attacks.

use wireshark for get thats packet , then sniff it , open armitage , scam the networking using nmap os detect 192.168.1.0/24 , u will have the attacker ip in local network , reattack him and its okay .

If he/she is ARP spoof, run "arp -a". If your router IP resolves to a MAC already listed, then you are being MITM'ed. Also there is an ettercap plugin that can detect this.

You can use these 2 scripts to detect MITM attacks. I don't take credit for either I just happen to have them both in my script collection.

Link to script: http://vladz.devzero.fr/svn/codes/bash/mitm.sh


Here's a link for a python version I just uploaded it for you guys called mitm_alert.py

https://app.box.com/s/n2olxty9ma7vhokd72b5


I pasted the bash script below for those who don't want to click the link. Don't worry I don't paste dumb links for AdFly or any of that ****. Hope this helps!



#!/bin/bash
# A fully customisable ARP spoofing detection script
#
# Copyright (C) 2008 vladz <[email protected]>
#
# This tool will prevent yourself against Man-In-The-Middle attacks. For
# better usage run this script in a xterm:
# $ xterm -e "/bin/bash mitm.sh"

f="/proc/net/arp" # Dump file of the kernel ARP table
t=5 # Time interval between two checks (in sec)
m="- WARNING - MITM detected" # Alert msg displayed when MITM occurs
d="+%y/%m/%d-%H:%M:%S" # Date format style

while true; do
sleep ${t}; awk '{if(x[$4]++) exit 1;}' ${f} || \
{ printf "*** At %s %s ***\n" "`date ${d}`" "${m}"; cat ${f}; }
done

Wireshark, will pick it up instantly.