Eset: ARP cache poisoning attack from G3100 router
Doc9898
Enthusiast - Level 2

Hi,

Lately Eset internet security has been going crazy with notifications that its blocking ARP Cache poisoning attacks and that there is a duplicate ip address at 192.168.1.1. That is strange because that is the source of the G3100 router and not sure whats going on or if the device has been compromised or is this a false positive due to how the router works.

Thanks

0 Likes
Reply
1 Solution
Doc9898
Enthusiast - Level 2

Turns out I had another router that I had configured to use as a switch and somehow the settings reset and it was running as another dhcp server. Once I realized the source I was able to fix the problem.

Thanks

View solution in original post

5 Replies
Cang_Household
Community Leader
Community Leader

Do you have other networking devices on your network? This could potentially be an IP conflict after all. Do you have other routers and modems that are not powered down completely?

Doc9898
Enthusiast - Level 2

Turns out I had another router that I had configured to use as a switch and somehow the settings reset and it was running as another dhcp server. Once I realized the source I was able to fix the problem.

Thanks

Cang_Household
Community Leader
Community Leader

I thought that too.

Doc9898
Enthusiast - Level 2

oops

0 Likes
Reply
dslr595148
Community Leader
Community Leader

Points to https://www.comparitech.com/blog/information-security/arp-poisoning-spoofing-detect-prevent/

to where it says How to detect ARP poisoning and as well as the first three listed options on How to prevent ARP poisoning.

Maybe also the fourth option on How to prevent ARP poisoning.