Devaus

This is because at the moment i have only connected 2 PC hardwired to Router and my phone and tablet connected wirelessly. My NAS and Managed + unmanaged switch are switched off and not connected. Thanks I will try this once i have connected all the previous equipment and post it here and this time i will follow your advice and directly connect the Managed switch to Router not connect to unmanaged switch.

Thanks for this article. Thanks for this nifty Software. I can verify that data in both match. https://drive.google.com/file/d/1Ons_m0lXsT36v9_dCfq-HbQqqY9fGHXs/view?usp=sharing Thanks for pointing that out i will correct that. I cannot fine tune the configuration in xARP as they are only available in Pro version but i am happy with the basic settings.

Correct link to Previous Network https://drive.google.com/file/d/15CzC4mlg6cf0YJOI3F3TpFW-pwlCG2KO/view?usp=sharing

Yes one of my PC was doing something which xARP didn't like so that PC is offline since then. Will reset it once i have time and re-connect to network. Yes my i unmanaged/dumb Netgear GS116 v2 Switch that connected 2 PC and NETGEAR GS108Tv2 ProSafe 8-Port which connected my NAS with link aggregation and 1 PoE switch that connects my 2 IP cameras are connected to Router. All switch are offline now. But whenever i connect devices from any switch i can see those warnings in xARP constantly but nothing in ESET. Now i have only 2 PC connected directly to router and xARP only showed warning when the PC were connected. After that xARP has been quiet. MY NVR is not connected to network and so are 2 IP cameras which connected via PoE switch. My previous network https://drive.google.com/file/d/1O92zls2FlUyApOk8U8gq8HshFT4Bn_Yq/view?usp=sharing Current Network https://drive.google.com/file/d/1Thbmf-1In4OdhzGwgZ64DMW-bXtdwT_z/view?usp=sharing

You are right. As soon as a new device connects i can see a "ARP Attack" message popup but funnily enough it did not do so when i connected first 2 devices which were Wife's PC and and iPhone. So got 4 popup message each time i connected my media PC, Galaxy Tablet, and iPad. But XARP went crazy when i connected my PC so i guess there is something in my PC so i will reformat it and see how i go. I have changed the router and i am using my old Dlink DIR-635 for the time being. Both ESET & Sophos have not given any warning about ARP attack so i guess everything is good. Big Thanks to you and Marcos.🙏🙏

I have not tried doing it with a software or otherwise. If not then is someone else is doing that from my PC. Half an hour ago another PC which my wife uses changed IP by itself as seen in screenshot where you can see 2 IP with same MAC. She is using Sophos and Cisco Anyconnect VPN to connect to work which has currently allocated 10.1.4.56 IP. This happened after the internet got disconnected the seconnd time in 2 hour. ESET did not detect the IP change nor did Sophos so i guess everything is fine.

No change after disabling xARP. However since posting this thread the pages are loading faster and everything looks normal. However today ESET popped an notification that an new device has connected to network (Screenshot Attached). the weird thing is it does not show the IP address but the MAC address shown is of My NVR but one digit higher example NVR mac is a0-4d-yf-ce-d0-c8 the new device MAC is a0-4d-yf-ce-d0-c9 and none of IP camera have this MAC. At that time i was not running xARP so could not see it in the logs. It is free with a nagging screen that is why i exited the program. It has a commercial version but for me it will be useless It might suit IT Security Professionals. i have not reset the Router as i will loose the settings and address reservation and it a pain adding them again. I have reset it long time back but when i imported the settings it did not import it correctly. It is Netgear D6400. I have rebooted it though. Will resetting it do any good?

Hi, Yesterday i saw “ARP CACHE POISONING” message on Eset security and then i could see the webpages taking time to load. I googled “ARP CACHE POISONING” and then installed and started xARP and saw “Status: ARP attacks detected” In xARP i can see a cross sign on the ip address of the pc and the router the alert screen of xARP showing these 2 messages: CorruptFilter: ethernet sender mac does not match arp sender mac MacFilter: Incoming packet but sender mac set to our own mac address I have attached the screenshots of the program. I fear but not sure that the PC and mobile phones and ipad are hacked or compromised.i also have got nvr and ip cameras on the network. Can some please help me or guide me to get rid of it Here are xARP screenshots https://drive.google.com/file/d/1_8bh5t-LFQhuw4Yg73t78TRoSc0E3grM/view Thanks