We will now look at how to use Wireshark to find suspicious activity within our network. Before we go any further, we need to change a few settings inside Wireshark; go to Edit | Preferences... under Protocols, find ARP/RARP and enable the option to Detect ARP request storms:
This will notify us if anybody is trying to discover any devices on the network. Click on OK and begin starting the capture by clicking on Capture | Start:
Now we need to switch to the Kali machine and use netdiscover. Instead of ARP poisoning, ...
