Use Wireshark’s built‑in ARP duplicate detection and traffic‑consistency checks to spot ARP spoofing and MITM on a LAN. Combine real‑time filters with the Endpoints and Conversations statistics to verify that one IP maps to multiple MACs or that packet‑timing anomalies exist.
1. Capture on the target VLAN – start Wireshark on a TAP or SPAN port; set the capture filter to arp or ip.
2. Enable ARP duplicate detection – go to Edit → Preferences → Protocols → ARP and check Detect duplicate address; Wireshark will flag packets with the display filter arp.duplicate-address-detected.
3. Inspect Ethernet endpoints – Statistics → Endpoints → Ethernet; sort by “IP Address” and look for rows where the same IP appears with two different MACs (threshold: >1 MAC per IP).
4. Check for inconsistent TTL/RTT – apply ip.ttl != 64 (or your network’s baseline) and frame.time_delta > 0.2 to reveal out‑of‑order or delayed packets, common in MITM.
5. Analyze TCP stream integrity – use tcp.analysis.flags && tcp.analysis.retransmission to catch duplicate ACKs or retransmissions that indicate packet injection.
6. Correlate with conversation stats – Statistics → Conversations → IPv4; unusually high bidirectional byte counts between a host and an unknown MAC suggest a rogue relay.
| Indicator | ARP Spoof | MITM |
|---|---|---|
| Duplicate IP‑MAC mapping | ✔ | ✖ |
| Unexpected TTL variance | ✖ | ✔ |
| Asymmetric RTT or retransmissions | ✖ | ✔ |
Gotcha: In virtualized or NIC‑teamed environments, a single VM may legitimately present multiple MAC addresses, causing false‑positive duplicate‑address alerts; whitelist known virtual MAC ranges before raising alarms.