Detecting suspicious behavior

We will now look at how to use Wireshark to find suspicious activity within our network. Before we go any further, we need to change a few settings inside Wireshark; go to Edit | Preferences... under Protocols, find ARP/RARP and enable the option to Detect ARP request storms:

This will notify us if anybody is trying to discover any devices on the network. Click on OK and begin starting the capture by clicking on Capture | Start:

Now we need to switch to the Kali machine and use netdiscover. Instead of ARP poisoning, ...

Get Learn Ethical Hacking from Scratch now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.