zillah 0 Posted March 13, 2020 Share Posted March 13, 2020 Dear Experts The below ESET knowledgeBase is related to ARP, ICMP or DNS Cache Poisoning Attack : https://support.eset.com/en/kb2933-arp-icmp-or-dns-cache-poisoning-attack-in-eset-home-products-for-windows Mine is mainly duplicate ip address on network and yes there is one alert for ARP Cache Poisoning attack as per snapshot below : How can I fix the duplicate ip addresses ? Thx Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted March 14, 2020 Administrators Share Posted March 14, 2020 Make sure that devices in your network receive a unique IP address from the DHCP server. Link to comment Share on other sites More sharing options...
zillah 0 Posted March 14, 2020 Author Share Posted March 14, 2020 Thx Admin I have only DHCP server which is my router on the network Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted March 14, 2020 Administrators Share Posted March 14, 2020 Are you positive that all machines / devices are configured to obtain the IP address automatically from the DHCP server? Couldn't it be that some devices have a static IP address assigned? Link to comment Share on other sites More sharing options...
zillah 0 Posted March 14, 2020 Author Share Posted March 14, 2020 Please check the DHCP address range on the my router it is from 200-250. And all the duplicate ip addresses in my first post were less than 200 Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted March 14, 2020 Administrators Share Posted March 14, 2020 You can enable advanced network protection logging under Tools -> Diagnostics, reproduce the detection of duplicate IP addresses, stop logging, collect logs with ESET Log Collector and upload the generated archive here. Link to comment Share on other sites More sharing options...
zillah 0 Posted March 14, 2020 Author Share Posted March 14, 2020 Thanks will do that Link to comment Share on other sites More sharing options...
zillah 0 Posted March 14, 2020 Author Share Posted March 14, 2020 I tried Advanced Setup --> Tools --> Diagnostic --> Advanced Logging --> Then failed to find reproduce the detection of duplicate IP addresses, stop logging ? I am digging in the right direction ? Link to comment Share on other sites More sharing options...
itman 1,659 Posted March 14, 2020 Share Posted March 14, 2020 Open a command prompt window, type "ipconfig /all" less the quote marks, and press the enter key. Post what is shown for IPv4 address and Subnet Mask. Link to comment Share on other sites More sharing options...
zillah 0 Posted March 14, 2020 Author Share Posted March 14, 2020 C:\WINDOWS\system32>ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : FUNNYNAME Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No Ethernet adapter Ethernet: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : TeamViewer VPN Adapter Physical Address. . . . . . . . . : 00-AA-6E-B5-2B-14 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Realtek PCIe GbE Family Controller Physical Address. . . . . . . . . : 88-D7-F6-3B-64-FF DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::31a0:c3a6:d5e4:74e%14(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.10.10(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.10.1 DNS Servers . . . . . . . . . . . : 192.168.10.1 NetBIOS over Tcpip. . . . . . . . : Enabled Link to comment Share on other sites More sharing options...
itman 1,659 Posted March 14, 2020 Share Posted March 14, 2020 (edited) Per your ipconfig screen shot, this is what I expected. Eset establishes its DHCP range based on what Win DHCP initialization establishes. In this case, the DHCP range is 192.10.10.1/24. However, your router appears to have the capability to restrict the actual DHCP range used to a subset of addresses within the above Win allocated DHCP range; something I have never seen before. The problem is that Eset is unaware of this subset restriction. Assuming you are using the Eset Home/Office firewall network adapter protection type, the only possible solution to this I can think of is to set the Trusted Zone to correspond to the actual DHCP address range you are using. That is,192.10.10.200-192.10.10.250. BTW- Edit out your MAC address on the posted screen shot. Edited March 14, 2020 by itman Link to comment Share on other sites More sharing options...
zillah 0 Posted March 14, 2020 Author Share Posted March 14, 2020 (edited) Thanks itman interesting Quote Eset establishes its DHCP range based on what Win DHCP initialization establishes. In this case, the DHCP range is 192.10.10.1/24. Where can I see that DHCP option within ESET ? Quote On what Win DHCP initialization establishes Are you saying ESET DHCP linked to windows DHCP ?I didn't get that Regards Edited March 14, 2020 by zillah Link to comment Share on other sites More sharing options...
itman 1,659 Posted March 14, 2020 Share Posted March 14, 2020 (edited) 13 hours ago, zillah said: Where can I see that DHCP option with ESET ? You can't. It's implied and used to set up IP addresses in the Trusted Zone when the Home/Office protection option is selected for the network adapter. 13 hours ago, zillah said: Are you saying ESET DHCP linked to windows DHCP ? Yes. Edited March 15, 2020 by itman Link to comment Share on other sites More sharing options...
zillah 0 Posted March 15, 2020 Author Share Posted March 15, 2020 I see Thanks for help Link to comment Share on other sites More sharing options...
Recommended Posts