ARP Attack from Nest thermostats

[vingear]

In the Orbi logs i see entries coming from a couple of my Nest thermostats.

"[DoS Attack: ARP Attack] from source:" nest IP

I contacted nest to ask about this and they said its the first they have heard about this kinda traffic coming from the devices. I was told the devies use ARP mapping. Could this possibly trigger a false positive in the router logs? How can I check to be for sure?

ORBI RBR50

Router Firmware Version
V2.5.1.8

[FURRYe38]

It would be false. I have a 1st and 3rd gen NEST stats and haven't seen this on mine. 

[CrimpOn]

---

@vingear wrote:

"[DoS Attack: ARP Attack] from source:" nest IP

---

Is this literally what the log shows, or have you edited out the MAC address and put "nest IP" in its place?

An ARP conflict can happen when two devices think they have the same IP address.

https://en.wikipedia.org/wiki/ARP_spoofing 

It might be worth a minute to look through the Orbi Attached Devices web page and verify that the devices on it have the IP addresses that they should.  I really wish that Netgear published information explaining what these Denial of Service reports mean.  I sometimes think that OpenWRT that Orbi is built on had this firewall code baked into it and no one at Netgear has any idea what it does.  (I am old and cynical.)

[vingear]

It only shows device IP and time. Now that I'm looking at the logs again, I notice that now my PC triggered the log. I wonder if this is happening because I started using my pihole as my DHCP server.

[FURRYe38]

And if you turn Off the phones DHCP server? 

Thanks for editing out the MAC address of the controller. Good idea not to post that in public forums. 

---

@vingear wrote:

It only shows device IP and time. Now that I'm looking at the logs again, I notice that now my PC triggered the log. I wonder if this is happening because I started using my pihole as my DHCP server.

---

[kilroym42]

I'm seeing the same thing in my Logs and now the router is freazing up once or twice a day.

[FURRYe38]

Do you have the Orbi system or RAX router? 

---

@kilroym42 wrote:

I'm seeing the same thing in my Logs and now the router is freazing up once or twice a day.

---