MiM can be used to redirect the flow between two hosts through a third host which logs it in tcpdump/pcap format. We use unsolicited ARPs to do this.