NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

Dennisf1's avatar
Dennisf1
Aspirant
Jul 27, 2019

Orbi Log capturing ARP attacks from an internal device (TP-Link HS200)

Multiple arp attacks showing in netgear log. Seems to be generating from my TP-Link HS200 smart light switch.

I have seen it occur in multiple log entries and well as log files. Is this something I should be concerned with or is it a debug or known-issue with the HS200 or the Router/Satelites. Running firmware V2.3.5.30 on router and satelites.

 

Any feedback on this woul dbe appreciated.

Regards,

Dennis

3 Replies

Sort By
  • CrimpOn's avatar
    CrimpOn
    Guru
    Jul 27, 2019

    ARP attacks, hmm.  I have looked at two months of Orbi logs and find only three "ARP Attacks", one from my own desktop and two from Spectrum's gateway.

     

    If these persist, it might be useful to turn on the Orbi debug capture (on the debug page) and then use a packet analyzer (such as Wireshark) to find the actual ARP packets.  I do not know how many ARP entries Orbi needs to declare an "attack".  Typically, my LAN captures show gazillions of ARP requests.  Every device seems to be asking "Who has <ip>?" all the time.

    • Dennisf1's avatar
      Dennisf1
      Aspirant
      Jul 27, 2019

      Crimpon:

      Thanks for the speedy reply. I will turn on the ORBI debug mode, then use my wireshark to track the packets.

      Not sure how to turn on the orbi debug mode, but I'm sure I'll find it.

      I'll report back my findings.

      Thanks

      Dennis