Orbi RBR50 suddenly getting [DoS Attack: ARP Attack]

---

PSIU wrote:

Not sure what happened and hoping some can help. My Orbi RBR50 is getting a lot of messages similar to the ones shown below for some reason. What should i do? 

---

There is nothing anyone can do about attempts to connect to the public IP address from the internet.  It is "public".  The post says "suddenly".  Is this correct?  Or, was this the first time you looked at the Orbi log?

I collect the logs from two separate Orbi systems (typical OCD behavior).  Both systems log this sort of thing all day, every day, typically about 65 entries per day.  This has been going on for 18 months, and neither system has ever failed in any way.  There were two periods when the number of events suddenly increased to every two seconds for about 24 hours before whoever was doing that quit.  There is an option to have the Orbi no longer log these events.  They still happen, but the log does not fill up with entries about them.

The fact that these "attempts" are logged indicates that the Orbi is aware of them, rejected them, and made a note.

This is similar to Robocalls.  There is no way to stop people from making them.  What customers CAN do it (a) never answer a call from a number they do not recognize, and (b) set up their phone to automatically reject calls with certain parameters (such as no CallerID at all). But, they cannot stop Robocalls from happening.

Some forum members have commented:

• Creating the log entries consumer some Orbi resources. (no one knows how much).
  Stopping the log function will free up those resources.
• Some people feel that Netgear's algorithms detect "attacks" that are not actually real.
  i.e. they count how many packets of a certain type arrive from a specific IP address in a certain time and decide, "THIS time it's malicious. Log it."  Since Netgear does not publish their algorithms, there is no way to validate this possibility.

Wow. This rant wasn't what you wanted. Sorry.