Duplicate ip address on network

[zillah 0]

Dear Experts

The below  ESET knowledgeBase is related to ARP, ICMP or DNS Cache Poisoning Attack :

https://support.eset.com/en/kb2933-arp-icmp-or-dns-cache-poisoning-attack-in-eset-home-products-for-windows

Mine is mainly duplicate ip address on network and yes there is one alert for ARP Cache Poisoning attack as per snapshot below :

How can I fix the duplicate ip addresses ?

Thx

 

[Marcos 5,451]

Make sure that devices in your network receive a unique IP address from the DHCP server.

[zillah 0]

Thx Admin

I have only DHCP server which is my router on the network

[Marcos 5,451]

Are you positive that all machines  / devices are configured to obtain the IP address automatically from the DHCP server? Couldn't it be that some devices have a static IP address assigned?

[zillah 0]

Please check the DHCP address range on the my router it is from 200-250.

And all the duplicate ip addresses in my first post were less than 200

[Marcos 5,451]

You can enable advanced network protection logging under Tools -> Diagnostics, reproduce the detection of duplicate IP addresses, stop logging, collect logs with ESET Log Collector and upload the generated archive here.

[zillah 0]

Thanks will do that

[zillah 0]

I tried Advanced Setup --> Tools --> Diagnostic --> Advanced Logging --> Then failed to find reproduce the detection of duplicate IP addresses, stop logging ?

I am digging in the right direction ?

[itman 1,801]

Open a command prompt window, type "ipconfig /all" less the quote marks, and press the enter key.

Post what is shown for IPv4 address and Subnet Mask.

[zillah 0]

C:\WINDOWS\system32>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : FUNNYNAME
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Ethernet:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TeamViewer VPN Adapter
   Physical Address. . . . . . . . . : 00-AA-6E-B5-2B-14
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Realtek PCIe GbE Family Controller
   Physical Address. . . . . . . . . : 88-D7-F6-3B-64-FF
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::31a0:c3a6:d5e4:74e%14(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.10.10(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.10.1
   DNS Servers . . . . . . . . . . . : 192.168.10.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

 

[itman 1,801]

Per your ipconfig screen shot, this is what I expected.

Eset establishes its DHCP range based on what Win DHCP initialization establishes. In this case, the DHCP range is 192.10.10.1/24. However, your router appears to have the capability to restrict the actual DHCP range used to a subset of addresses within the above Win allocated DHCP range; something I have never seen before. The problem is that Eset is unaware of this subset restriction.

Assuming you are using the Eset Home/Office firewall network adapter protection type, the only possible solution to this I can think of is to set the Trusted Zone to correspond to the actual DHCP address range you are using. That is,192.10.10.200-192.10.10.250.

BTW- Edit out your MAC address on the posted screen shot.

Edited March 14, 2020 by itman

[zillah 0]

Thanks itman interesting

Quote

Eset establishes its DHCP range based on what Win DHCP initialization establishes. In this case, the DHCP range is 192.10.10.1/24.

Where can I see that DHCP option within ESET ?

 

Quote

On what Win DHCP initialization establishes

Are you saying ESET DHCP linked to windows DHCP ?I didn't get that

 

Regards

Edited March 14, 2020 by zillah

[itman 1,801]

13 hours ago, zillah said:

Where can I see that DHCP option with ESET ?

You can't. It's implied and used to set up IP addresses in the Trusted Zone when the Home/Office protection option is selected for the network adapter.

13 hours ago, zillah said:

Are you saying ESET DHCP linked to windows DHCP ?

Yes.

Edited March 15, 2020 by itman

[zillah 0]

I see

Thanks for help