Learn Ethical Hacking from Scratch

Detecting suspicious behavior

We will now look at how to use Wireshark to find suspicious activity within our network. Before we go any further, we need to change a few settings inside Wireshark; go to Edit | Preferences... under Protocols, find ARP/RARP and enable the option to Detect ARP request storms:

This will notify us if anybody is trying to discover any devices on the network. Click on OK and begin starting the capture by clicking on Capture | Start:

Now we need to switch to the Kali machine and use netdiscover. Instead of ARP poisoning, ...