I have tried to perform a mitm attack on one of my pc's which has Eset antivirus installed.
I tried to intercept http/https data by forwarding port 80 & 443 with iptables. Then I used arpspoof command along with mitmproxy for the attack. I also used a on-the-fly ssl certificate with mitmproxy. Once I put everything in place and started the attack, the antivirus on my target pc immediately detected and blocked the attack.
The message I got is the following: Network event blocked - Duplicate IP addresses on network A computer on the network is sending malicious traffic. This can be an attempt to attack your computer. Well yes I redirected the traffic.
So I would like to know, how the antivirus actually was able to detect the attack?