A MitM attack can occur from layer 2 up of the TCP/IP stack. In the example you linked to, this is a ARP attack, but you could also intercept traffic at the application level (e.g., technically a web proxy would be a MitM).
MitM is a class of attacks with the explicit purpose of intercepting traffic, either to listen or modify. As @M'vy notes, technically when you have MitM you can choose what to do with the traffic you intercept, so you could drop the traffic which would be a DoS. However, there are other easier things to do on the local network for DoS (e.g., fake DHCP and point you to do bad gateway or DNS).
If you are on the local network and you want to see what services are running on a victim's machine you can do a port scan using something like nmap
and see what services are running. If you want to see what a victim's outbound traffic is you can simply monitor traffic using something like wireshark
or something like p0f
. You don't need to have MitM to see what is inside the broadcast domain, MitM could possibly be noisy or detected so you wouldn't want to necessarily use it just to see what's going on.
In terms of defense, things like 802.1x and Network Admission Control can help. These techniques help to ensure you are only talking to legitimate endpoints and to keep unauthorized nodes off of the network.
Other technologies that can help prevent MitM attacks at layer 2 / 3:
- DHCP Snooping - "The fundamental use case for DHCP snooping is to prevent unauthorized (rogue) DHCP servers offering IP addresses to DHCP clients. Rogue DHCP servers are often used in man in the middle or denial of service attacks for malicious purposes."
- Dynamic ARP Inspection - "Dynamic ARP inspection (DAI) is a security feature that rejects invalid and malicious ARP packets. The feature prevents a class of man-in-the-middle attacks, where an unfriendly station intercepts traffic for other stations by poisoning the ARP caches of its unsuspecting neighbors. "
- IP Source Guard - "P Source Guard is a security feature that restricts IP traffic on untrusted Layer 2 ports by filtering traffic based on the DHCP snooping binding database or manually configured IP source bindings."
To prevent a DoS attack you would want to get the local attacker's node off or your network. You may be able to filter traffic once you know the MAC/IP of the attacker (assuming its not constantly changing) on your endpoint. At the network level you may be able to configure your switch/router to disable the port of the attacker based on bad behavior. You will need to read the docs for your specific equipment to see if its possible with what you have.