ARP table inconsistencies are often a sign of on-path attacks because attackers frequently use ARP spoofing to insert themselves in the communication path between two systems. If there are unexplained changes or anomalies in the ARP cache, it could indicate that someone is redirecting the traffic to their device. SSL certificate mismatch notices would not directly indicate the existence of an on-path attack; rather, they suggest a problem with the website's encryption. Unusual account lockouts are typically associated with password attacks or account takeover attempts. Increased ICMP traffic could be indicative of network scanning or reconnaissance, but not specifically an on-path attack.