What are you doing if you notice a MITM attack against a Linux server?

I got this question at a job interview, but I did not know the answer. I think they expected some shell command or packages, which can help react to the attack. I know it could be a linux question, but actually it is connecting to the IT security too.