Jump to content

Duplicate IP Addresses /Detected ARP cache poisoning attack

Recommended Posts

Hi everyone,


I live in an apartment with everyone sharing a NBN network and suddenly my laptop showed warning messages "Duplicate IP Addresses & Dected ARP cache poisoning attack".


When the instruction asked me to unblocked it....I did so.


Now, I am worried that this feature which Detects ARP cache poisoning attack and Duplicate IP address is turned off permanently.


Can you tell me how to turn it back on so my laptop is protected from eavesdropping please?


I use a Windows 7 and Smart Security 8 as well as Malwarebyte free version.


Thank you very much for your help.

Link to comment
Share on other sites

  • ESET Staff

Hi @star,


As is mention on ESET KB2933 that "attack" is just an internal traffic from you router or another device.

Try the KB and see if apply to your case.


About the duplicate IP address, you have to check all your devices IP, to see who has the same IP as you.

In the case you use manual IP for each device, just check in Routers list to find the duplicate one and


If you router act as DNS server for the internal home network, then be sure all your devices are set

to accept IP automatically.

Link to comment
Share on other sites

Hi Gonzalo,
Thank you for your advice.
I have viewed the given KB. This is what I see in the Zone Setup section - on the second line which says "Addresses excluded from active protection", no IP address was assigned. Does that mean the IP address which was previously detected ARP cache poisoning attack is now back under active protection (firewall) even though I allowed Eset to unblock it when the warning first came up.
Also In the advanced setup >> Personal Firewall >> IDS exceptions, I could see the detected Duplicate & ARP cache poisoning attack IP address is being categorized as Block = No, Notify = No and Log = No.
What does that mean? Is the IP address no longer Block because I gave Eset permission to unblock it when I was asked to choose to continue blocking or unblocking it?
Please see screenshot about the IDS exception hxxp://prntscr.com/8ngm9f
Please help me determine whether this unblocked IP address (which I gave permission initially) is back under active protection?


Thank you once again for your help.

Link to comment
Share on other sites

Hi TomFace,


Thank you for letting me know about a similar post. However, I couldn't find the answer from it. The problem is I clicked and allowed Eset to unblock an IP address when the warning came up. I now worry my laptop is vulnerable to eavesdrop as the IP address is no longer under active protection.


Nevertheless, thank you for your help.


Have a great weekend.

Link to comment
Share on other sites

  • ESET Staff

If you are concern about the past choice, can be undone.


The good part of ESET is you can restore the "default" configuration of that section only, using the

"Default" button below, just make sure you mark the only one for the section and not for all the product.

A reboot is highly suggested after apply the changes.

Link to comment
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...