Wireless Mesh Network (WMN) is a recent technology that is gaining significant importance among traditional wireless networks. WMN is considered a suitable solution for providing Internet access in an inexpensive, convenient, and rapid manner. Nonetheless, WMNs are exposed to various types of security threats due to their intrinsic characteristics such as open broadcast medium and decentralized architecture. For instance, a compromised node can generate malicious traffic in order to disrupt the network routing service, putting the entire mesh network at risk. In this paper, we provide an efficient method for detecting active attacks against the routing functionality of network. The approach is based on the analysis of the protocol routing behavior by processing the traces produced by each node using Mont image Monitoring Tool (MMT), which outputs routing events that are correlated between nodes to detect potential intrusions. We demonstrate the approach feasibility by using a virtualized mesh network platform that consists of virtual nodes executing Better Approach To Mobile Ad hoc Network (BATMAN) routing protocol. The experimental results show that the proposed method accurately identifies malicious routing traffic diffused by an attacker through the network.