Advice Request ARP attacks-CIS

[Nestor]

I am using CIS in my system and the last days,almost every day, i keep getting firewall alerts for ARP attacks.The attacted subject is windows operating system and the source IP is diferrent from the destination IP.iI have checked ARP protection at firewall settings.Does anyone know is this a FP or it's real?

 

[lowdetection]

Just a little head-up in case OP is interested, with dd-wrt we have ARP protection inside the router:

 

[ForgottenSeer 58943]

I am using CIS in my system and the last days,almost every day, i keep getting firewall alerts for ARP attacks.The attacted subject is windows operating system and the source IP is diferrent from the destination IP.iI have checked ARP protection at firewall settings.Does anyone know is this a FP or it's real?

Assuming the subject and target are on your local domain/subnet, which is where it probably is then you need to tell us the source and IP addresses, and identify the local subject attempting to poison your ARP. Utilize Advanced IP Scanner to find the bad actor;

Advanced IP Scanner - Download Free Network Scanner.

ARP is a protocol which is being used inside a network (layer 2) to convert IP addresses to MAC addresses. ARP requests are very spoofable since they aren't secured in any way. So you may have a bad actor on your network and simply need to identify it. Some devices, like Fingbox utilize ARP manipulation to conduct their operations, which is not ideal. Make sure you don't have a second router on the network or a L3 managed switch malfunctioning as well. Anything tampering with your ARP tables should be removed from the network. Also, you should have a device to protect ARP integrity on the device handing out DHCP. Fortunately, a growing number of routers and ALL UTM's provide some level of ARP protection. I was shocked - recently - to find Linksys's higher end routers are ARP secured out of the box. Crap routers(most) will be oblivious to ARP manipulation.

Identify the bad actor, remove it. It's possible the bad actor is a benign piece of equipment that's been hijacked. Factory reset it, if it can't be reset, toss it in the trash. It could be a transient device as well, so work on ID.

 

[Nestor]

Assuming the subject and target are on your local domain/subnet, which is where it probably is then you need to tell us the source and IP addresses, and identify the local subject attempting to poison your ARP. Utilize Advanced IP Scanner to find the bad actor;

Advanced IP Scanner - Download Free Network Scanner.

ARP is a protocol which is being used inside a network (layer 2) to convert IP addresses to MAC addresses. ARP requests are very spoofable since they aren't secured in any way. So you may have a bad actor on your network and simply need to identify it. Some devices, like Fingbox utilize ARP manipulation to conduct their operations, which is not ideal. Make sure you don't have a second router on the network or a L3 managed switch malfunctioning as well. Anything tampering with your ARP tables should be removed from the network. Also, you should have a device to protect ARP integrity on the device handing out DHCP. Fortunately, a growing number of routers and ALL UTM's provide some level of ARP protection. I was shocked - recently - to find Linksys's higher end routers are ARP secured out of the box. Crap routers(most) will be oblivious to ARP manipulation.

Identify the bad actor, remove it. It's possible the bad actor is a benign piece of equipment that's been hijacked. Factory reset it, if it can't be reset, toss it in the trash. It could be a transient device as well, so work on ID.

Thank you for your help,i will try it!
I don't have second router on the network,the router is an old netfaster WLAN3.

 

[lowdetection]

That confirms that the device is vulnerable, and maybe already compromised;

honestly from when I am on dd-wrt, I faced some issues, but at least the firmware is updated, Index of /dd-wrtv2/downloads/betas/2018/08-14-2018-r36596/

unfortunately they don't support the tee for making a little IDS project I wanted make, but they are awesome,

I suggest you find a valid replacement and load dd-wrt on it

You probably are exposed also to various others security problem like Krack...

My router is an old TPLINK WDR3600, and is not updated from years from vendors, also, they have a known bug with Hitman.Pro Alert loading the WEB-GUI, so back then I researched what I can use, and that fitted me so good, also I can remote SSH into it, and reboot, that is the best thing I need, I was using antiARP-Spoofing application on Android, but then I removed it and ticked the option inside the router.

 

[ForgottenSeer 58943]

Netfaster if I recall was an old rebrand of old SMC routers. That router has to be over a decade old, isn't it?

I do not believe it has any ARP protection at all on it like LD says. Still, you should identify the offending agent on your network, which may turn out to be the router itself. You are incredibly vulnerable with an old SMC/Netfaster.

 

[Nestor]

That confirms that the device is vulnerable, and maybe already compromised;

honestly from when I am on dd-wrt, I faced some issues, but at least the firmware is updated, Index of /dd-wrtv2/downloads/betas/2018/08-14-2018-r36596/

unfortunately they don't support the tee for making a little IDS project I wanted make, but they are awesome,

I suggest you find a valid replacement and load dd-wrt on it

You probably are exposed also to various others security problem like Krack...

I just checked it with F-Secure Router Checher for possible hijacks and says it's fine.

 

[Nestor]

Netfaster if I recall was an old rebrand of old SMC routers. That router has to be over a decade old, isn't it?

I do not believe it has any ARP protection at all on it like LD says. Still, you should identify the offending agent on your network, which may turn out to be the router itself. You are incredibly vulnerable with an old SMC/Netfaster.

Yes it's old, probably a decade, i have to change it but i will try to reset although according to F-Secure router checker it's not hijacked.

 

[ForgottenSeer 58943]

Identify the local bad actor before doing anything. Those router checker software/sites are 100% garbage.

 

[lowdetection]

KRACK Attacks: Breaking WPA2

You should check using this from Linux:

vanhoefm/krackattacks-scripts