Eset: ARP cache poisoning attack from G3100 router

[Doc9898]

Hi,

Lately Eset internet security has been going crazy with notifications that its blocking ARP Cache poisoning attacks and that there is a duplicate ip address at 192.168.1.1. That is strange because that is the source of the G3100 router and not sure whats going on or if the device has been compromised or is this a false positive due to how the router works.

Thanks

[dslr595148]

Points to https://www.comparitech.com/blog/information-security/arp-poisoning-spoofing-detect-prevent/

to where it says How to detect ARP poisoning and as well as the first three listed options on How to prevent ARP poisoning.

Maybe also the fourth option on How to prevent ARP poisoning.

[Cang_Household]

Do you have other networking devices on your network? This could potentially be an IP conflict after all. Do you have other routers and modems that are not powered down completely?

[Doc9898 · Accepted solution]

Turns out I had another router that I had configured to use as a switch and somehow the settings reset and it was running as another dhcp server. Once I realized the source I was able to fix the problem.

Thanks

[Cang_Household]

I thought that too.

[Doc9898]

oops