<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting Man-in-the-Middle Attacks — API & Tool Reference

> Quick reference for tools, commands, and APIs used in detecting-man-in-the-middle-attacks.

## Tools

### `arpwatch`

ARP activity monitor for IP/MAC mapping changes

**Usage:**
```bash
arpwatch -i eth0 -f /var/lib/arpwatch/arp.dat
```

**Key Flags:**
  - `-i: interface`
  - `-f: data file`
  - `-m: email notifications`

---

### `tshark`

Command-line packet analyzer

**Usage:**
```bash
tshark -i eth0 -f "arp" -Y "arp.duplicate-address-detected"
```

**Key Flags:**
  - `-i: capture interface`
  - `-f: capture filter (BPF)`
  - `-Y: display filter`
  - `-T json: JSON output`

---

### `nmap`

Rogue service detection

**Usage:**
```bash
nmap -sU -p 67,68,137,5355 --open 10.0.0.0/24
```

**Key Flags:**
  - `-sU: UDP scan`
  - `-p: port specification`
  - `--open: show only open ports`

---

## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Cross-reference findings with multiple tools where possible

## See Also

- Parent skill: [Network Security](../../../SKILL.md)
- Technique SKILL.md: [../SKILL.md](../SKILL.md)
