NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
Orbi generating a lot of ARP traffic on WAN
Using Orbi, I have problems being deactivated by my ISP due to too much ARP noise on the wan port.
Reported this to support but no luck so far getting any help so wanted to see if anyone have similar experiences?
My ISP uses Cisco DAI where the orbi (after a couple of days use) breaches the set limit of 50 arp packets per s.
After persuading the ISP to manually re-enable my port a couple of times, I hooked up the orbi to my pc, acting as a router in front of internet.
Using wireshark to analyse the traffic, I can see the orbi continuously sending multiple arp requests per second to the (simulated) default router on the wan side. The router answers back nicely so no reason for orbi to ask again milliseconds later.
I will monitor for a couple of days and suspect to see the same breach identified by my ISP. Already seen up to 10 ARP requests per s, which (including ARP responses) would breach the Cisco default of 15 pps.
- Problem still there after upgrade to 1.5.0.12. Will try the newer 1.8.0.6 as a next step. Tried to find what has actually been fixed but seems Netgear is not open with this and support will not tell..
- Arp traffic on wan link still there without any clients on the LAN
- Disabled UPnP but no difference (and this shouldn't generate traffic on the wan anyway, right?)
- Orbi log warned about a DoS ARP attack at the time it breached the 50 limit so seems it detects there's a problem - just isn't aware it created it itself;)
Any ideas?
Reported this to support but no luck so far getting any help so wanted to see if anyone have similar experiences?
My ISP uses Cisco DAI where the orbi (after a couple of days use) breaches the set limit of 50 arp packets per s.
After persuading the ISP to manually re-enable my port a couple of times, I hooked up the orbi to my pc, acting as a router in front of internet.
Using wireshark to analyse the traffic, I can see the orbi continuously sending multiple arp requests per second to the (simulated) default router on the wan side. The router answers back nicely so no reason for orbi to ask again milliseconds later.
I will monitor for a couple of days and suspect to see the same breach identified by my ISP. Already seen up to 10 ARP requests per s, which (including ARP responses) would breach the Cisco default of 15 pps.
- Problem still there after upgrade to 1.5.0.12. Will try the newer 1.8.0.6 as a next step. Tried to find what has actually been fixed but seems Netgear is not open with this and support will not tell..
- Arp traffic on wan link still there without any clients on the LAN
- Disabled UPnP but no difference (and this shouldn't generate traffic on the wan anyway, right?)
- Orbi log warned about a DoS ARP attack at the time it breached the 50 limit so seems it detects there's a problem - just isn't aware it created it itself;)
Any ideas?
V1.12.0.18 fixed the issue!
21 Replies
- I am seeing this on the 1.8.0.6 firmware too. My log is constantly reporting this.
- Nothing wrong with the DoS detection. Normally this message would indicate there's an attack over Internet, which is nice to be protected from.
However in my case I can see the packages are generated by the orbi itself. - Agree but I am just assuming an issue due to the amount of reports in the log, as I did not utilize a packet analyzer. Either I am seriously being attacked on my personal home network or something else.
I was going through logs on my router today and found a ton of these attacks going on as well. However, I noticed the IP address the Orbi was saying was the source was my windows machine in my office. I've had the machine off for a for a bit now, and haven't seen another listing for this.
I know this is an older post now, but if anyone comes across it like I did, note the IP address listed in your logs and see if maybe something on your network is the source.
I'll be sanitizing my PC this weekend (YAAAAAAAY... i actually enjoy doing that)- Interesting find. My Orbi is dropping internet connection several times a day and Orbi is unable to get renew IP/DNS details when it happens. But the connection comes back after a while so mybe I'm being disabled by my ISP too - but temporarily. Got loads of ARP messages in my log similar to yours.
Got a support case going and running on test-firmware but they are having trouble finding the cause it seems. - I have provided Netgear support a number of network dumps where it clearly shows my orbi broadcasting arp request for the default gw on the wan side several times per second, sometimes twice per millisecond. Got a message from them yesterday that they managed to narrow down the problem and will provide a new firmware within a week. Looking forward to (hopefully) get rid of this.
The hidden debug menu was useful collecting data http://router/debug.htm. You can even enable telnet access. Things like this should not be hidden - would have saved me a lot of time if I knew about it from start. - Good to know they are on it. I've sent debug logs and other details earlier and I'm now running on debug/test firmware (.12). Hopefully we will soon see a solution for both yr and my issue(s).
- Quick update:
tested a beta firmware with no improvement, maybe even worse..
upgraded to 1.9.1.12 a couple of weeks ago after a couple of hours I could see an ARP storm, over 100 packets per s. with requests from the router to my ISP default gw and my ISP blocked my port automatically (No blame on them as this is clearly the Netgear router misbehaving).
Seems I'm stuck using the orbi as an AP and use another router, or I might just return it. I wouldn't recommend it to anyone. Netgear has been working on the problem for over 2 months. Orbi is not a new product anymore and I doubt they will spend much time on new firmware versions going forward. - Thanks for adding your info and logging this with Netgear. Hopefully this will put some attention to the case.
I still have the same problem, now using V1.10.1.2 as well. I still have the case open with Netgear and they ask for more logs generated with their debug tool, but as this is only able to log around 10mins at a time it's practically impossible to catch it. I have provided a number of externally generated wireshark logs however that clearly shows the problem, but no one seems to bother about my case anymore at Netgear.
I'm stuck using the device as an AP (where it's doing an ok job)Though for me raising the limit to 50 improved a lot. Before I had tens of disconnects per day. In the last few days I noticed only one, while using the network all day long. I'm using the Orbi as a router.
UnixGuy,
I had my connection raised to 100 ARP/s and that improved a lot again, but I still had a few very rare disconnections. Then I updated to 1.11.0.20 and I didn't have any in the last week. Can you maybe check the ARP traffic with 1.11.0.20? Also, it looks like a beta 1.12 is out. Thanks
- Just upgraded my orbi to a beta 1.12.0.12 that is supposed to solve the problem. Has been running fine for a day now so looks promising.. but sometimes if has been days before the problem occurred before as well.
I haven't been able to convince my ISP to do any changes on their side and they have the limit set to 50 packets per sec.Curious to know whether the beta firmware solved it or if the issue still there?
V1.12.0.18 fixed the issue!