What do you think about this ARP attack log in my router?


  1. EOF
    Posts : 73
    Win7 Ultimate
       #1

    What do you think about this ARP attack log in my router?


    Hi!
    I looked today into the log section of my router, and I found some strange listing about some sort of ARP attack.

    I didn't know who are these source IP addresses come from. They are unknown to me.

    Should I take any action?

    Thanks.
    What do you think about this ARP attack log in my router? Attached Files
      My Computer


  2. Posts : 794
    Microsoft Windows 10 Pro 64-bit
       #2

    Your router stopped any attack so you don't have to worry about your log file, It's the ones you may not see that are troubling most routers if not all are setup to block any unsolicited request so you are usually safe.

    there are literally millions of hackers and script kiddies trying to find way to make money on the net every second of the day.

    Fun fact --Determined hackers can scan and enumerate services on the entire IPv4 address range in less than an hour.


    Years ago I used to go threw my router logs every month or two, My ISP recently replaced my router and it does not have this feature.

    I took the liberty of looking up those IP's in your log, If your interested I posted it to pastebin since it is a large wall of text. I also included at the end how I used Windows WSL Ubuntu in powershell to do it.

    IP-info.txt - Pastebin.com
      My Computer


  3. Posts : 1,244
    Windows 10 Pro x64 21H2 (Build: 19044.1415)
       #3

    @EOF

    If you want to do some investigation first step is to note down known hosts on same segment.

    Then run:
    Code:
    arp -a
    And make sure all IP entries match correct MAC entry that you gathered.

    You could write a simple script that would compare ARP cache output against it's own list of dynamically mapped entries and report any IP\MAC discrepancies.

    And if that happens, you could launch your own ARP discovery against bad entry to learn more about target host.
    You could also simply block specific hosts in router or in case of wireless change WI-FI password.
    Last edited by zebal; 11 Apr 2021 at 03:40.
      My Computer


  4. Posts : 794
    Microsoft Windows 10 Pro 64-bit
       #4

    zebal said:
    You could write a simple script that would compare ARP cache output against it's own list of dynamically mapped entries and report any IP\MAC discrepancies.
    No point stopping there might as well go all in.

    Check for an added DHCP server
    Another added gateway
    A change of DNS servers

    I would imagine that a good security suite would include all and more though

    I just use Windows defender which as far as I know can't do any of that but Windows firewall may be able to force your present router as the gateway and force the DNS server of your choice I'm not sure though
      My Computer


  5. EOF
    Posts : 73
    Win7 Ultimate
    Thread Starter
       #5

    DL:
    Thank you for such of info, and the best part for me is the PasteBin site with your PS script.
    Pastbin is new to me.

    I'm familiar with scripting on some level and I can interpret your script well.

    Now I used it to target infos from another log.
    Where I found really nice infos and IP's

    Thank you.
      My Computer


  6. Posts : 794
    Microsoft Windows 10 Pro 64-bit
       #6

    EOF said:
    DL:
    Thank you for such of info, and the best part for me is the PasteBin site with your PS script.
    Pastbin is new to me.

    I'm familiar with scripting on some level and I can interpret your script well.

    Now I used it to target infos from another log.
    Where I found really nice infos and IP's

    Thank you.
    It's actually bash terminal command's, Although I was using powershell it's the new version in preview release right now and I was using Linux commands. I have WSL 2 installed but I think WSL 1 would work too

    GitHub - microsoft/terminal: The new Windows Terminal and the original Windows console host, all in the same place!
    Releases . microsoft/terminal . GitHub


    What do you think about this ARP attack log in my router?-power.png
      My Computer


  7. EOF
    Posts : 73
    Win7 Ultimate
    Thread Starter
       #7

    Are you also using Azure?
      My Computer


  8. Posts : 794
    Microsoft Windows 10 Pro 64-bit
       #8

    EOF said:
    Are you also using Azure?
    No thats the way it comes I have not bothered to find out how to get rid of it. It defaults to Powershell which I use the most and once in a while I use Ubuntu so I don't see it that much
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 06:56.
Find Us




Windows 10 Forums