Wireless mesh network (WMN) is a recent technology that is gaining significant importance among traditional wireless networks. It is considered a suitable solution for providing internet access in an inexpensive, convenient, and rapid manner. Nonetheless, WMNs are exposed to various types of security threats due to their intrinsic characteristics such as open broadcast medium and decentralised architecture. For instance, a compromised node can generate malicious traffic in order to disrupt the network routing service, putting the entire mesh network at risk. In this paper, we provide an efficient method for detecting active attacks against the routing functionality of a mesh network. The approach relies on the analysis of the protocol routing behaviour by processing the traces produced by each node using the Montimage Monitoring Tool (MMT), which outputs routing events that are correlated between nodes to detect potential intrusions. We demonstrate the approach feasibility by using a virtualised mesh network platform that consists of virtual nodes executing 'better approach to mobile ad hoc network' (BATMAN) routing protocol. The experimental results show that the proposed method accurately identifies malicious routing traffic diffused by an attacker through the network