× NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
× Introducing the new Orbi 770 Series Mesh System. To learn more click here.

Start a New Discussion

Start a New Discussion

Orbi WiFi 7 RBE973
Reply

DoS Attack: ARP Attack when my Orbi Pro satellite is plugged in

SCDock
Aspirant
Aspirant
‎2022-07-04 11:23 AM
‎2022-07-04 11:23 AM

DoS Attack: ARP Attack when my Orbi Pro satellite is plugged in

My electrician wired the Orbi Pro ceiling mount satellite incorrectly, so that when the switch for the lights are turned off, the power to the satellite goes out as well.  We have been meaning to fix this, but it was not a big deal because it is just for wifi in one end of the warehouse and the light is always on when they are working.  We typically would just have to wait a few minutes after the lights were on until the wifi would work again.  In the last couple weeks, we started getting DoS Attack: ARP Attack in the logs that takes down the network for about 10 minutes when the light switch is turned on.  Any idea why this would all of a sudden start happening?  The IP addresses on the attacks in the logs are all local is addresses assigned by the main orbi to devices on the LAN.  I thought maybe if I used address reservation for the 4 satellites it would solve the problem, but it did not. Thoughts?  Logs below.

 

[DoS Attack: ARP Attack] from source: 192.168.1.200, Monday, July 04, 2022 12:04:11
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:04:10
[DoS Attack: ARP Attack] from source: 192.168.1.200, Monday, July 04, 2022 12:04:09
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:04:08
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:04:07
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:04:06
[DoS Attack: ARP Attack] from source: 192.168.1.39, Monday, July 04, 2022 12:04:05
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:04:03
[DoS Attack: ARP Attack] from source: 192.168.1.50, Monday, July 04, 2022 12:04:02
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:04:00
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:03:56
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:03:55
[DoS Attack: ARP Attack] from source: 192.168.1.98, Monday, July 04, 2022 12:03:54
[DoS Attack: ARP Attack] from source: 192.168.1.57, Monday, July 04, 2022 12:03:53
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:03:52
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:03:51
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:03:50
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:03:49
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:03:48
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:03:47
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:03:45
[DoS Attack: ARP Attack] from source: 192.168.1.6, Monday, July 04, 2022 12:03:44
[DoS Attack: ARP Attack] from source: 192.168.1.200, Monday, July 04, 2022 12:03:42
[DoS Attack: ARP Attack] from source: 192.168.1.50, Monday, July 04, 2022 12:03:41
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:03:40
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:03:39
[DoS Attack: ARP Attack] from source: 192.168.1.57, Monday, July 04, 2022 12:03:38
[DoS Attack: ARP Attack] from source: 192.168.1.6, Monday, July 04, 2022 12:03:37
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:03:36
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:03:35
[DoS Attack: ARP Attack] from source: 192.168.1.39, Monday, July 04, 2022 12:03:33
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:03:32
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:03:31
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:03:30
[DoS Attack: ARP Attack] from source: 192.168.1.50, Monday, July 04, 2022 12:03:29
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:03:28
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:03:27
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:03:26
[DoS Attack: ARP Attack] from source: 192.168.1.200, Monday, July 04, 2022 12:03:24
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:03:22
[DoS Attack: ARP Attack] from source: 192.168.1.50, Monday, July 04, 2022 12:03:21
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:03:18
[DoS Attack: ARP Attack] from source: 192.168.1.200, Monday, July 04, 2022 12:03:17
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:03:15
[DoS Attack: ARP Attack] from source: 192.168.1.57, Monday, July 04, 2022 12:03:12
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:03:11
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:03:08
[DoS Attack: ARP Attack] from source: 192.168.1.43, Monday, July 04, 2022 12:03:07
[DoS Attack: ARP Attack] from source: 192.168.1.98, Monday, July 04, 2022 12:03:05
[DoS Attack: ARP Attack] from source: 192.168.1.78, Monday, July 04, 2022 12:03:04
[DoS Attack: ARP Attack] from source: 192.168.1.200, Monday, July 04, 2022 12:03:03
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:03:02
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:03:01
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:03:00
[DoS Attack: ARP Attack] from source: 192.168.1.57, Monday, July 04, 2022 12:02:58
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:02:56
[DoS Attack: ARP Attack] from source: 192.168.1.57, Monday, July 04, 2022 12:02:55
[DoS Attack: ARP Attack] from source: 192.168.1.200, Monday, July 04, 2022 12:02:54
[DoS Attack: ARP Attack] from source: 192.168.1.50, Monday, July 04, 2022 12:02:53
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:02:52
[DoS Attack: ARP Attack] from source: 192.168.1.200, Monday, July 04, 2022 12:02:50
[DoS Attack: ARP Attack] from source: 192.168.1.50, Monday, July 04, 2022 12:02:49
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:02:48
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:02:45
[DoS Attack: ARP Attack] from source: 192.168.1.57, Monday, July 04, 2022 12:02:44
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:02:43
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:02:41
[DoS Attack: ARP Attack] from source: 192.168.1.43, Monday, July 04, 2022 12:02:40
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:02:39
[DoS Attack: ARP Attack] from source: 192.168.1.98, Monday, July 04, 2022 12:02:38
[DoS Attack: ARP Attack] from source: 192.168.1.200, Monday, July 04, 2022 12:02:36
[DoS Attack: ARP Attack] from source: 192.168.1.43, Monday, July 04, 2022 12:02:35
[DoS Attack: ARP Attack] from source: 192.168.1.50, Monday, July 04, 2022 12:02:34
[DoS Attack: ARP Attack] from source: 192.168.1.200, Monday, July 04, 2022 12:02:33
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:02:32
[DoS Attack: ARP Attack] from source: 192.168.1.41, Monday, July 04, 2022 12:02:31
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:02:30
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:02:29
[DoS Attack: ARP Attack] from source: 192.168.1.200, Monday, July 04, 2022 12:02:28
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:02:27
[DoS Attack: ARP Attack] from source: 192.168.1.200, Monday, July 04, 2022 12:02:26
[DoS Attack: ARP Attack] from source: 192.168.1.50, Monday, July 04, 2022 12:02:25
[DoS Attack: ARP Attack] from source: 192.168.1.98, Monday, July 04, 2022 12:02:24
[DoS Attack: ARP Attack] from source: 192.168.1.43, Monday, July 04, 2022 12:02:23
[DoS Attack: ARP Attack] from source: 192.168.1.78, Monday, July 04, 2022 12:02:22
[DoS Attack: ARP Attack] from source: 192.168.1.43, Monday, July 04, 2022 12:02:21
[DoS Attack: ARP Attack] from source: 192.168.1.200, Monday, July 04, 2022 12:02:20
[DoS Attack: ARP Attack] from source: 192.168.1.98, Monday, July 04, 2022 12:02:19
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:02:18
[DoS Attack: ARP Attack] from source: 192.168.1.200, Monday, July 04, 2022 12:02:17
[DoS Attack: ARP Attack] from source: 192.168.1.98, Monday, July 04, 2022 12:02:16
[DoS Attack: ARP Attack] from source: 192.168.1.43, Monday, July 04, 2022 12:02:15
[DoS Attack: ARP Attack] from source: 192.168.1.50, Monday, July 04, 2022 12:02:14
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:02:13
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:02:12
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:02:09
[DoS Attack: ARP Attack] from source: 192.168.1.43, Monday, July 04, 2022 12:02:08
[DoS Attack: ARP Attack] from source: 192.168.1.1, Monday, July 04, 2022 12:02:07
[DoS Attack: ARP Attack] from source: 192.168.1.98, Monday, July 04, 2022 12:02:06
[DoS Attack: ARP Attack] from source: 192.168.1.43, Monday, July 04, 2022 12:02:03
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:02:02
[DoS Attack: ARP Attack] from source: 192.168.1.43, Monday, July 04, 2022 12:02:00
[DoS Attack: ARP Attack] from source: 192.168.1.146, Monday, July 04, 2022 12:01:59
[DoS Attack: ARP Attack] from source: 192.168.1.43, Monday, July 04, 2022 12:01:58

Message 1 of 2
0 Kudos
Reply
CrimpOn
Guru Guru
Guru
‎2022-07-04 11:37 AM
‎2022-07-04 11:37 AM

Re: DoS Attack: ARP Attack when my Orbi Pro satellite is plugged in

The router has detected an abnormal number of ARP requests in a short time,  which it labels as a Denial of Service Attack.

My guess is that this is instead an ARP Storm caused by some device connecting to the newly activated satellite:

https://en.wikipedia.org/wiki/Broadcast_storm 

 

All those devices keep saying "Who has <a specific IP address>?" and answers come through different satellites.

  • It's over here.
  • No, it's over there.
  • No, it's over here.

If you captured the actual LAN packets using the feature on the debug page, my guess is that you would see all those ARP requests.

 

If this just started happening, it is probably some WiFi device that has been moved and now has a choice of satellites with strong signals.

 

There appear to be two solutions:

  • Turn the lights on 10 minutes before starting work, or
  • Keep the satellite powered on.
Message 2 of 2
0 Kudos
Reply
Top Contributors
See All
Discussion stats
  • 1 reply
  • ‎2022-07-04 11:23 AM
  • 1846 views
  • 0 kudos
  • 2 in conversation
Announcements

Orbi 770 Series