How to monitor ARP poisoning?
These few days my internal website that can be accessed locally has weird image replacing every images on the site for few seconds (it got back to normal after refreshing). I've checked the server, there are no suspicious action on the log, and the pictures that served by web server are not modified at the moment. So I believe that's got nothing to do with the server, but with the network.
Is there a way (or a daemon) that can monitor ARP poisoning?
Best Answer
The good old arpwatch is still useful. Other than that, it might be a good idea to capture all network traffic for a few days and analyse it.