I got this question at a job interview, but I did not know the answer. I think they expected some shell command or packages, which can help react to the attack. Assume that, you are a system admin and you work for the Nokia Networks. This server store customers details and communicate with them when a customer want to report a problem or bug through the global and 2 internal networks. The attackers are using DNS-poison and they can also start the attack from the internal network, but these details were not specified. I know it could be a linux question, but actually it is connecting to the IT security too.
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
If you notice that someone is actively man-in-the-middling a server the first thing you should do is inform your incident response/security team.
They should decide on mitigating controls, that's their task. It's highly dependable on what technology is being MiTM and in what way. It also depends largely on where the MiTM is occuring. Aside from re-adjusting routes to go across another network, there's not much you can do.
Keep in mind the context here - since it's an interview question, the goal is to assess your understanding of the terminology and concepts. They were probably not interested in some specific tool, or an exact command you would be running (although you might get kudos for knowing something like that).
As mentioned in comments, there are MANY specifics that could influence the answer, so don't bother with those. The point is to demonstrate you understand what a MITM attack is, potential ways it could be detected, and how relates to the job you were interviewing for.
For example, your answer could have been: "Well, a MITM attack involves a malicious user redirecting legitimate traffic through a machine they control. If I noticed this while working on a server, I was probably monitoring network traffic and saw something odd in the traffic patterns or in the ARP table. It's also possible I was reviewing the logs for a web server/application and I noticed abnormal activity from a single machine."