🛡️ Detecting MITM — what to watch for Look for unexpected ARP replies or frequent ARP changes, duplicate IP/MAC pairs, sudden certificate changes for known services, DNS responses that resolve to unusual hosts, and abnormal TLS handshakes (downgrades or missing chains). Spikes in traffic to new endpoints or unexplained outbound connections are also red flags. 📡 Capture strategy & safe filtering Capture on a mirror/span port or the affected host’s interface (with authorization) and use short, f