Karl Hui

Thank you for the reply. With multiple devices using the same IP, does it means my DHCP server has issue? Gonna have a look on the DHCP now

Dear all, Found out I should use 192.168.80.0/255.255.255.0 not just 192.168.80.0 in Addresses excluded from active protection (IDS), then no "Duplicate IP addresses detected in network" and"Detected ARP cache poisoning attack" alert anymore, however I would like to know if is it a false alarm or its real an attack? Thanks

Dear all, I'm new to this forum but I have using ESET Security Endpoint for a few months, starting yesterday I got "Duplicate IP addresses detected in network" and "Detected ARP cache poisoning attack" alert every few minutes. Those target and source IP are internal (192.168.80.xxx). I googled it, scan those computers with no virus, added 192.168.80.0 in Addresses excluded from active protection (IDS), however these alerts still keep poping up. I have no idea what cause this issue and seeking for help. Thank you very much.