Table 2: Evidence characterizing a link spoofing attack.

Initial-evidence group
A MPR is replaced by a 1-hop neighbor or by an already selected MPR
A MPR behaves maliciously, for example, it tampers, misrelays, or drops the control messages
Suspicious-evidence group
A MPR is the only node that provides connectivity to one (or more) 2-hops neighbor(s)
Confirmed-evidence group
A MPR advertises a partial set of 1-hop neighbors
A MPR advertises nonneighboring node(s) as 1-hop neighbors(s)
Cancel-evidence group
A MPR is defined as an intruder/well-behaving node