I suspect that my router (I'm using an iPhone as router) has been owned and the attacker is making some kind of mitm attack. I suspect also that some html and js code has not been sent to my laptop and filtered by the attacker, meaning that some sites do not have some functionalities.
If this is true, then there should be a hole in the TCP sequence number stream. How can I check the TCP sequence number integrity?
I'm using a Windows 10 VM in a Linux/ubuntu host with VirtualBox. My idea is to check the sequence number with snort or Wireshark from the host, but I'd appreciate some hint on alternatives.