×

Introducing the Orbi 970 Series Mesh System with WiFi 7(BE) technology. For more information visit the NETGEAR Press Room.

Orbi WiFi 7 RBE973
Reply

Re: ARP Attack from Nest thermostats

vingear
Aspirant

ARP Attack from Nest thermostats

In the Orbi logs i see entries coming from a couple of my Nest thermostats.

 

"[DoS Attack: ARP Attack] from source:" nest IP

 

I contacted nest to ask about this and they said its the first they have heard about this kinda traffic coming from the devices. I was told the devies use ARP mapping. Could this possibly trigger a false positive in the router logs? How can I check to be for sure?

 

 

ORBI RBR50

Router Firmware Version
V2.5.1.8

Model: RBR50|Orbi AC3000 Tri-band WiFi Router
Message 1 of 7
FURRYe38
Guru

Re: ARP Attack from Nest thermostats

It would be false. I have a 1st and 3rd gen NEST stats and haven't seen this on mine. 

Message 2 of 7
CrimpOn
Guru

Re: ARP Attack from Nest thermostats


@vingear wrote:

"[DoS Attack: ARP Attack] from source:" nest IP


Is this literally what the log shows, or have you edited out the MAC address and put "nest IP" in its place?

 

An ARP conflict can happen when two devices think they have the same IP address.

https://en.wikipedia.org/wiki/ARP_spoofing 

 

It might be worth a minute to look through the Orbi Attached Devices web page and verify that the devices on it have the IP addresses that they should.  I really wish that Netgear published information explaining what these Denial of Service reports mean.  I sometimes think that OpenWRT that Orbi is built on had this firewall code baked into it and no one at Netgear has any idea what it does.  (I am old and cynical.)

Message 3 of 7
vingear
Aspirant

Re: ARP Attack from Nest thermostats

It only shows device IP and time. Now that I'm looking at the logs again, I notice that now my PC triggered the log. I wonder if this is happening because I started using my pihole as my DHCP server.

Message 4 of 7
FURRYe38
Guru

Re: ARP Attack from Nest thermostats

And if you turn Off the phones DHCP server? 

 

Thanks for editing out the MAC address of the controller. Good idea not to post that in public forums. 


@vingear wrote:

It only shows device IP and time. Now that I'm looking at the logs again, I notice that now my PC triggered the log. I wonder if this is happening because I started using my pihole as my DHCP server.


 

Message 5 of 7
kilroym42
Aspirant

Re: ARP Attack from Nest thermostats

I'm seeing the same thing in my Logs and now the router is freazing up once or twice a day.

 

Model: RAX40|Nighthawk AX4 4-Stream WiFi Router
Message 6 of 7
FURRYe38
Guru

Re: ARP Attack from Nest thermostats

Do you have the Orbi system or RAX router? 


@kilroym42 wrote:

I'm seeing the same thing in my Logs and now the router is freazing up once or twice a day.

 


 

Message 7 of 7
Top Contributors
Discussion stats
  • 6 replies
  • 1295 views
  • 0 kudos
  • 4 in conversation
Announcements

Orbi WiFi 7