Reply
Highlighted
Guide

Orbi generating a lot of ARP traffic on WAN

Using Orbi, I have problems being deactivated by my ISP due to too much ARP noise on the wan port.
Reported this to support but no luck so far getting any help so wanted to see if anyone have similar experiences?

My ISP uses Cisco DAI where the orbi (after a couple of days use) breaches the set limit of 50 arp packets per s.
After persuading the ISP to manually re-enable my port a couple of times, I hooked up the orbi to my pc, acting as a router in front of internet.

Using wireshark to analyse the traffic, I can see the orbi continuously sending multiple arp requests per second to the (simulated) default router on the wan side. The router answers back nicely so no reason for orbi to ask again milliseconds later.
I will monitor for a couple of days and suspect to see the same breach identified by my ISP. Already seen up to 10 ARP requests per s, which (including ARP responses) would breach the Cisco default of 15 pps.
- Problem still there after upgrade to 1.5.0.12. Will try the newer 1.8.0.6 as a next step. Tried to find what has actually been fixed but seems Netgear is not open with this and support will not tell..
- Arp traffic on wan link still there without any clients on the LAN
- Disabled UPnP but no difference (and this shouldn't generate traffic on the wan anyway, right?)
- Orbi log warned about a DoS ARP attack at the time it breached the 50 limit so seems it detects there's a problem - just isn't aware it created it itselfSmiley Wink

Any ideas?
Message 1 of 22

Accepted Solutions
Highlighted
Guide

Re: Orbi generating a lot of ARP traffic on WAN

V1.12.0.18 fixed the issue!

View solution in original post

Message 18 of 22

All Replies
Highlighted
Star

Re: Orbi generating a lot of ARP traffic on WAN

I am seeing this on the 1.8.0.6 firmware too. My log is constantly reporting this.
Message 2 of 22
Highlighted
Guide

Re: Orbi generating a lot of ARP traffic on WAN

Nothing wrong with the DoS detection. Normally this message would indicate there's an attack over Internet, which is nice to be protected from.
However in my case I can see the packages are generated by the orbi itself.
Message 3 of 22
Highlighted
Star

Re: Orbi generating a lot of ARP traffic on WAN

Agree but I am just assuming an issue due to the amount of reports in the log, as I did not utilize a packet analyzer. Either I am seriously being attacked on my personal home network or something else.
Message 4 of 22
Highlighted
Aspirant

Re: Orbi generating a lot of ARP traffic on WAN

I was going through logs on my router today and found a ton of these attacks going on as well.  However, I noticed the IP address the Orbi was saying was the source was my windows machine in my office.  I've had the machine off for a for a bit now, and haven't seen another listing for this.

I know this is an older post now, but if anyone comes across it like I did, note the IP address listed in your logs and see if maybe something on your network is the source.

I'll be sanitizing my PC this weekend (YAAAAAAAY... i actually enjoy doing that)

 

Message 5 of 22
Highlighted
Star

Re: Orbi generating a lot of ARP traffic on WAN

Interesting find. My Orbi is dropping internet connection several times a day and Orbi is unable to get renew IP/DNS details when it happens. But the connection comes back after a while so mybe I'm being disabled by my ISP too - but temporarily. Got loads of ARP messages in my log similar to yours.

Got a support case going and running on test-firmware but they are having trouble finding the cause it seems.

Message 6 of 22
Highlighted
Guide

Re: Orbi generating a lot of ARP traffic on WAN

I have provided Netgear support a number of network dumps where it clearly shows my orbi broadcasting arp request for the default gw on the wan side several times per second, sometimes twice per millisecond. Got a message from them yesterday that they managed to narrow down the problem and will provide a new firmware within a week. Looking forward to (hopefully) get rid of this.

The hidden debug menu was useful collecting data http://router/debug.htm. You can even enable telnet access. Things like this should not be hidden - would have saved me a lot of time if I knew about it from start.
Message 7 of 22
Highlighted
Star

Re: Orbi generating a lot of ARP traffic on WAN

Good to know they are on it. I've sent debug logs and other details earlier and I'm now running on debug/test firmware (.12). Hopefully we will soon see a solution for both yr and my issue(s).
Message 8 of 22
Highlighted
Guide

Re: Orbi generating a lot of ARP traffic on WAN

Quick update:
tested a beta firmware with no improvement, maybe even worse..
upgraded to 1.9.1.12 a couple of weeks ago after a couple of hours I could see an ARP storm, over 100 packets per s. with requests from the router to my ISP default gw and my ISP blocked my port automatically (No blame on them as this is clearly the Netgear router misbehaving).
Seems I'm stuck using the orbi as an AP and use another router, or I might just return it. I wouldn't recommend it to anyone. Netgear has been working on the problem for over 2 months. Orbi is not a new product anymore and I doubt they will spend much time on new firmware versions going forward.
Message 9 of 22
Highlighted
Guide

Re: Orbi generating a lot of ARP traffic on WAN

UnixGuy, same thing here. Do you have any news?

Message 10 of 22
Highlighted
Guide

Re: Orbi generating a lot of ARP traffic on WAN

For the record, I had my ISP increase DAI limit to 50 ARP requests per second and I didn't see a disconnection in the last few days. Before I had 5-10 each day.

Message 11 of 22
Highlighted
Guide

Re: Orbi generating a lot of ARP traffic on WAN

Some more info:

 

- All of this still happens with latest firmware as of 18 June 2017. Router Firmware Version V1.10.1.2.

- I have definitely much less disconnects now, though I still had one yesterday. So yes, it seems Orbi can actually send more than 50 ARP/s.

- I also opened a case with Netgear, explained the issue and provided links to this forum thread.

- So, it's clear there's a problem and it's clear they know well. If this doesn't get fixed, it's either Netgear unwilling or unable to fix it

 

Message 12 of 22
Highlighted
Guide

Re: Orbi generating a lot of ARP traffic on WAN

Thanks for adding your info and logging this with Netgear. Hopefully this will put some attention to the case.
I still have the same problem, now using V1.10.1.2 as well. I still have the case open with Netgear and they ask for more logs generated with their debug tool, but as this is only able to log around 10mins at a time it's practically impossible to catch it. I have provided a number of externally generated wireshark logs however that clearly shows the problem, but no one seems to bother about my case anymore at Netgear.
I'm stuck using the device as an AP (where it's doing an ok job)
Message 13 of 22
Highlighted
Guide

Re: Orbi generating a lot of ARP traffic on WAN

Though for me raising the limit to 50 improved a lot. Before I had tens of disconnects per day. In the last few days I noticed only one, while using the network all day long. I'm using the Orbi as a router.

Message 14 of 22
Highlighted
Guide

Re: Orbi generating a lot of ARP traffic on WAN

UnixGuy,

 

I had my connection raised to 100 ARP/s and that improved a lot again, but I still had a few very rare disconnections. Then I updated to 1.11.0.20 and I didn't have any in the last week. Can you maybe check the ARP traffic with 1.11.0.20? Also, it looks like a beta 1.12 is out. Thanks

Message 15 of 22
Highlighted
Guide

Re: Orbi generating a lot of ARP traffic on WAN

Just upgraded my orbi to a beta 1.12.0.12 that is supposed to solve the problem. Has been running fine for a day now so looks promising.. but sometimes if has been days before the problem occurred before as well.
I haven't been able to convince my ISP to do any changes on their side and they have the limit set to 50 packets per sec.
Message 16 of 22
Highlighted
Aspirant

Re: Orbi generating a lot of ARP traffic on WAN

Curious to know whether the beta firmware solved it or if the issue still there?

Message 17 of 22
Highlighted
Guide

Re: Orbi generating a lot of ARP traffic on WAN

V1.12.0.18 fixed the issue!

View solution in original post

Message 18 of 22
Highlighted
Aspirant

Re: Orbi generating a lot of ARP traffic on WAN DoS Attack

 

Running V2.1.1.16 (as of 1/3/2018)

My Orbi log is full of "DoS Attack: ACK Scan" (ARP traffic)

Intermittent wireless/dropped WiFi connection

Sometimes having to reset the connection by unplugging the modem 

I will call my IPS to have my connection raised to 100 ARP/s

Message 19 of 22
Highlighted
Aspirant

Re: Orbi generating a lot of ARP traffic on WAN DoS Attack

I called my IPS to have my connection limit raised to 100 DAI reqs/sec

The phone rep. could not find any info on "DAI" limit

I have an appointment with a field reps later today. 

Message 20 of 22
Highlighted
Guide

Re: Orbi generating a lot of ARP traffic on WAN

Just to confirm what @fefigno said. V1.12.0.18 fixed the issue for me as well and I have been running without problems since upgrading 4-5 months ago.  Sorry for the late update.

Message 21 of 22
Highlighted
Guide

Re: Orbi generating a lot of ARP traffic on WAN

no, the beta didn't solbe the problem, but as posted below - the later official versions did.

Message 22 of 22
Top Contributors
Discussion stats
  • 21 replies
  • 4921 views
  • 9 kudos
  • 7 in conversation
Announcements