Reply

Re: Satellite starts DoS Attack: ARP Attack when connected to Ethernet

Edgar_dc
Initiate

Satellite starts DoS Attack: ARP Attack when connected to Ethernet

Router Firmware Version
V2.1.4.16

Last night the internet access when down. After looking for a cause, I found that as soon as the satellite is conected to ethernet it starts an "ARP attack". Sample from the logs:

[DoS Attack: ARP Attack] from source: 192.168.1.6, Monday, August 06, 2018 14:49:41
[DHCP IP: 192.168.1.10] to MAC address 00:d0:2d:5f:c2:53, Monday, August 06, 2018 14:49:41
[DHCP IP: 192.168.1.10] to MAC address 00:d0:2d:5f:c2:53, Monday, August 06, 2018 14:49:40
[DHCP IP: 192.168.1.10] to MAC address 00:d0:2d:5f:c2:53, Monday, August 06, 2018 14:49:40
[DoS Attack: ARP Attack] from source: 192.168.1.10, Monday, August 06, 2018 14:49:39
[DHCP IP: 192.168.1.10] to MAC address 00:d0:2d:5f:c2:53, Monday, August 06, 2018 14:49:39
[DoS Attack: ARP Attack] from source: 192.168.1.10, Monday, August 06, 2018 14:49:38
[DHCP IP: 192.168.1.10] to MAC address 00:d0:2d:5f:c2:53, Monday, August 06, 2018 14:49:37
[DoS Attack: ARP Attack] from source: 192.168.1.6, Monday, August 06, 2018 14:49:37
[DHCP IP: 192.168.1.10] to MAC address 00:d0:2d:5f:c2:53, Monday, August 06, 2018 14:49:37
[DHCP IP: 192.168.1.10] to MAC address 00:d0:2d:5f:c2:53, Monday, August 06, 2018 14:49:37
[DHCP IP: 192.168.1.10] to MAC address 00:d0:2d:5f:c2:53, Monday, August 06, 2018 14:49:37
[DoS Attack: ARP Attack] from source: 192.168.1.6, Monday, August 06, 2018 14:49:36
[DHCP IP: 192.168.1.10] to MAC address 00:d0:2d:5f:c2:53, Monday, August 06, 2018 14:49:36
[DHCP IP: 192.168.1.10] to MAC address 00:d0:2d:5f:c2:53, Monday, August 06, 2018 14:49:35
[DoS Attack: ARP Attack] from source: 192.168.1.6, Monday, August 06, 2018 14:49:35
[DHCP IP: 192.168.1.10] to MAC address 00:d0:2d:5f:c2:53, Monday, August 06, 2018 14:49:35
[DHCP IP: 192.168.1.10] to MAC address 00:d0:2d:5f:c2:53, Monday, August 06, 2018 14:49:34
[DoS Attack: ARP Attack] from source: 192.168.1.10, Monday, August 06, 2018 14:49:34
[DHCP IP: 192.168.1.10] to MAC address 00:d0:2d:5f:c2:53, Monday, August 06, 2018 14:49:34
[DHCP IP: 192.168.1.10] to MAC address 00:d0:2d:5f:c2:53, Monday, August 06, 2018 14:49:33
[DoS Attack: ARP Attack] from source: 192.168.1.6, Monday, August 06, 2018 14:49:33
[DHCP IP: 192.168.1.10] to MAC address 00:d0:2d:5f:c2:53, Monday, August 06, 2018 14:49:33
[DHCP IP: 192.168.1.10] to MAC address 00:d0:2d:5f:c2:53, Monday, August 06, 2018 14:49:32

And this crashes the internet connection.

I have tried to turn on/off, reset the satellite, but no avail. Currently I have the satellite unplug from ethernet. 

Model: RBK50| Orbi AC3000 High-Performance Tri-Band WiFi System
Message 1 of 16

Accepted Solutions
RatChickens
Tutor

Re: Satellite starts DoS Attack: ARP Attack when connected to Ethernet

Unplugging the TPLink switches while connecting the satellites worked! After verifying the network was happy I plugged the switches back in and everything works.

Thanks for the help!

View solution in original post

Message 13 of 16

All Replies
DarrenM
Sr. NETGEAR Moderator

Re: Satellite starts DoS Attack: ARP Attack when connected to Ethernet

Hello Edgar_dc

 

I have sent you a PM.

 

DarrenM

Message 2 of 16
zN
Aspirant
Aspirant

Re: Satellite starts DoS Attack: ARP Attack when connected to Ethernet

I have the same issue. It's to the point where the router is not usable anymore. I connected an old router to get online but dont want to end up a $350 door stop. 

 

Can you share what your recommendations are on this?

Model: RBK50| Orbi AC3000 High-Performance Tri-Band WiFi System
Message 3 of 16
FURRYe38
Guru

Re: Satellite starts DoS Attack: ARP Attack when connected to Ethernet

What FW is currently loaded?
What is the Mfr and model# of the IP modem the Orbi is connected too?

What is the size of your home? Sq Ft?
What is the distance between the router and satellite(s)? 30 feet is recommended in between them to begin with depending upon building materials.

I would do a factory reset on the router and satellite and set up from scratch. Try disabling the following:
MIMO, Daisy Chain, Fast Roaming, IPv6 and Set 20/40Mhz Coexistence to 40Mhz only. Save settings and reboot the router and satellite(s). Turn OFF ALL other devices accept for 1 wired PC with the router. Walk thru the setup wizard. Skip adding the satellites during the wizard. After you set up the router and give a new SSID and PW and the router is rebooted. Go in and sync the router and 1 satellite first. You can do this in the same room with the router and satellites. After you get one synced, set an IP address reservation for the 1 satellite. Add, Save and Apply. Turn of the 1st satellite and turn on the 2nd satellite and get it connected. Do the same IP address reservation for the 2nd satellite. Add, Save and Apply. Turn off the satellite and then place each satellite in there remote locations.

 

Check Connected devices after placing satellites. Check internet access. If good,

Begin to turn on the rest of the home devices.


What channels are you using? Auto? Try setting manual channel 1, 6 or 11 on 2.4Ghz and any unused channel on 5Ghz.
Any Wifi Neighbors near by? If so, how many?


@zN wrote:

I have the same issue. It's to the point where the router is not usable anymore. I connected an old router to get online but dont want to end up a $350 door stop. 

 

Can you share what your recommendations are on this?





 

My Setup (Cable 1Gbps/50Mbps)>CAX80 v2.1.2.1(LAG Disabled)>RBK853 v4.6.3.16
Additional NG HW: C7800/CM1100/CM1200CM2000, Orbi CBK40, CBR750, RBK50(v22), SXR30(v110), R7000(v34), R7800(v84), R7960P(v82), EX7500/EX7700, XR450(v120) and WNHDE111
Message 4 of 16
RatChickens
Tutor

Re: Satellite starts DoS Attack: ARP Attack when connected to Ethernet

I also have this same exact problem. I had to unplug one of my satellites today and when I powered it back up it initially connects via Ethernet but soon after the status page shows it’s connected wirelessly. Shortly after that my entire network dies. If I unplug the Ethernet from the satellite everything work. The router shows the same ARP attack messages.

It seems like the satellite is back hauling on both Ethernet and wireless and everything gets messed up.
Message 5 of 16
FURRYe38
Guru

Re: Satellite starts DoS Attack: ARP Attack when connected to Ethernet

What FW is currently loaded?
What is the Mfr and model# of the IP modem the Orbi is connected too? 

What is the size of your home? Sq Ft? 
What is the distance between the router and satellite(s)? 30 feet is recommended in between them to begin with depending upon building materials.

I would do a factory reset on the router and satellite and set up from scratch. Try disabling the following:
MIMO, Daisy Chain, Fast Roaming, IPv6 and Set 20/40Mhz Coexistence to 40Mhz only. Save settings and reboot the router and satellite(s). Turn OFF ALL other devices accept for 1 wired PC with the router. Walk thru the setup wizard. Skip adding the satellites during the wizard. After you set up the router and give a new SSID and PW and the router is rebooted. Go in and sync the router and 1 satellite first. You can do this in the same room with the router and satellites. After you get one synced, set an IP address reservation for the 1 satellite. Add, Save and Apply. Turn of the 1st satellite and turn on the 2nd satellite and get it connected. Do the same IP address reservation for the 2nd satellite. Add, Save and Apply. Turn off the satellite and then place each satellite in there remote locations.

 

Check Connected devices after placing satellites. Check internet access. If good,

Begin to turn on the rest of the home devices.


What channels are you using? Auto? Try setting manual channel 1, 6 or 11 on 2.4Ghz and any unused channel on 5Ghz.
Any Wifi Neighbors near by? If so, how many?


@RatChickens wrote:
I also have this same exact problem. I had to unplug one of my satellites today and when I powered it back up it initially connects via Ethernet but soon after the status page shows it’s connected wirelessly. Shortly after that my entire network dies. If I unplug the Ethernet from the satellite everything work. The router shows the same ARP attack messages.

It seems like the satellite is back hauling on both Ethernet and wireless and everything gets messed up.

 

My Setup (Cable 1Gbps/50Mbps)>CAX80 v2.1.2.1(LAG Disabled)>RBK853 v4.6.3.16
Additional NG HW: C7800/CM1100/CM1200CM2000, Orbi CBK40, CBR750, RBK50(v22), SXR30(v110), R7000(v34), R7800(v84), R7960P(v82), EX7500/EX7700, XR450(v120) and WNHDE111
Message 6 of 16
RatChickens
Tutor

Re: Satellite starts DoS Attack: ARP Attack when connected to Ethernet

Firmware: 2.1.4.16
Modem:  Netgear CM500-1AZNAS
4000 sq ft
~35 ft to one satellite, ~45 ft to the other
I'm not sure why any of the wireless settings matter.  My problems are specific to ethernet backhaul.  If I use wireless, I have no problems other than the satellite that is further away has problems getting a signal from the router (which is why i want to use ethernet backhaul).  The second I start using ethernet, the satellite goes nuts, sending a ton of traffic over the wired interface, the router shows the ARP attack in the logs, and my network dies..  As soon as I unplug the ethernet from the satellite everything works fine.
I had these problems when I initially setup the network, but after numerous power cycles, everything started working, and has worked for 10 months.  Things only freaked out yesterday as I had to power off parts of the system to do electical work.
When I try to reserve an IP for a satellite, I get
400 Bad Request
This server does not support the operation requested by your client.
I've heard that the 2.2 Beta Firmware helps resolve backhaul issues.  How can i get involved with that Beta?
 

@FURRYe38 wrote:

What FW is currently loaded?
What is the Mfr and model# of the IP modem the Orbi is connected too? 

What is the size of your home? Sq Ft? 
What is the distance between the router and satellite(s)? 30 feet is recommended in between them to begin with depending upon building materials.

I would do a factory reset on the router and satellite and set up from scratch. Try disabling the following:
MIMO, Daisy Chain, Fast Roaming, IPv6 and Set 20/40Mhz Coexistence to 40Mhz only. Save settings and reboot the router and satellite(s). Turn OFF ALL other devices accept for 1 wired PC with the router. Walk thru the setup wizard. Skip adding the satellites during the wizard. After you set up the router and give a new SSID and PW and the router is rebooted. Go in and sync the router and 1 satellite first. You can do this in the same room with the router and satellites. After you get one synced, set an IP address reservation for the 1 satellite. Add, Save and Apply. Turn of the 1st satellite and turn on the 2nd satellite and get it connected. Do the same IP address reservation for the 2nd satellite. Add, Save and Apply. Turn off the satellite and then place each satellite in there remote locations.

 

Check Connected devices after placing satellites. Check internet access. If good,

Begin to turn on the rest of the home devices.


What channels are you using? Auto? Try setting manual channel 1, 6 or 11 on 2.4Ghz and any unused channel on 5Ghz.
Any Wifi Neighbors near by? If so, how many?


@RatChickens wrote:
I also have this same exact problem. I had to unplug one of my satellites today and when I powered it back up it initially connects via Ethernet but soon after the status page shows it’s connected wirelessly. Shortly after that my entire network dies. If I unplug the Ethernet from the satellite everything work. The router shows the same ARP attack messages.

It seems like the satellite is back hauling on both Ethernet and wireless and everything gets messed up.

 


Message 7 of 16
FURRYe38
Guru

Re: Satellite starts DoS Attack: ARP Attack when connected to Ethernet

What is the Mfr and model# of the ethernet switch if one is in the configuration

 

Turn OFF ALL other devices accept for 1 wired PC with the router. Walk thru the setup wizard. Skip adding the satellites during the wizard. After you set up the router and give a new SSID and PW and the router is rebooted. Go in and sync the router and 1 satellite first. You can do this in the same room with the router and satellites. After you get one synced, set an IP address reservation for the 1 satellite. Add, Save and Apply. Turn of the 1st satellite and turn on the 2nd satellite and get it connected. Do the same IP address reservation for the 2nd satellite. Add, Save and Apply. Turn off the satellite and then place each satellite in there remote locations.


Check Connected devices after placing satellites. Check internet access. If good,

Begin to turn on the rest of the home devices.

 

Yes, try the beta as well...

 


@RatChickens wrote:
Firmware: 2.1.4.16
Modem:  Netgear CM500-1AZNAS
4000 sq ft
~35 ft to one satellite, ~45 ft to the other
I'm not sure why any of the wireless settings matter.  My problems are specific to ethernet backhaul.  If I use wireless, I have no problems other than the satellite that is further away has problems getting a signal from the router (which is why i want to use ethernet backhaul).  The second I start using ethernet, the satellite goes nuts, sending a ton of traffic over the wired interface, the router shows the ARP attack in the logs, and my network dies..  As soon as I unplug the ethernet from the satellite everything works fine.
I had these problems when I initially setup the network, but after numerous power cycles, everything started working, and has worked for 10 months.  Things only freaked out yesterday as I had to power off parts of the system to do electical work.
When I try to reserve an IP for a satellite, I get
400 Bad Request
This server does not support the operation requested by your client.
I've heard that the 2.2 Beta Firmware helps resolve backhaul issues.  How can i get involved with that Beta?
 

 




 

My Setup (Cable 1Gbps/50Mbps)>CAX80 v2.1.2.1(LAG Disabled)>RBK853 v4.6.3.16
Additional NG HW: C7800/CM1100/CM1200CM2000, Orbi CBK40, CBR750, RBK50(v22), SXR30(v110), R7000(v34), R7800(v84), R7960P(v82), EX7500/EX7700, XR450(v120) and WNHDE111
Message 8 of 16
RatChickens
Tutor

Re: Satellite starts DoS Attack: ARP Attack when connected to Ethernet

None of this setup mentions Ethernet. When setting up Ethernet do you power everything up and get it working wirelessly then plug in Ethernet?

How do I get access to the Beta Firmware?

The central switch being used is a Netgear GS316. This is the main switch being used for backhaul. I also have a TPLink TL-SG108, and 2x TL-SG105. These distribute Ethernet in various rooms.

Message 9 of 16
FURRYe38
Guru

Re: Satellite starts DoS Attack: ARP Attack when connected to Ethernet

Sorry I should have edited it for wired, this method works showever after you get the 1st satellite added via wireless, connect the ethernet cable, wait 5 minutes for the top LED to turn on BLUE. Then do a IP address reservation ON the router for the satellite. Once done, turn OFF the satellite and do the same process for the 2nd satellite. When you get both setup via ethernet, turn OFF then place in remote locations. Then turn on and wait for the top LEDs to turn on BLUE again. If that happens, then re-connect your main network and LAN devices. 

 

Question regarding switches is that prior users have mentioned that managed switches don't work well with the Orbi system. One user found that IGMP protools are the cause of this on managed switches, 

Looking at your's I believe they are non managed however they do mention support for IGMP:

https://www.tp-link.com/us/products/details/cat-42_TL-SG105.html

https://www.tp-link.com/us/products/details/cat-42_TL-SG108.html

I believe these shouldn't be a problem, however you can determine if they are by removing them temporarily from the network or just directly connecting the satellites to the back of the Orbi router. If they connect there ok, and they don't for some reason while connected to the switches in between, then the switches would be the cause. So my suggestion would be to setup the satellites while in the same room as the router and using a patch cable, set them up one at a time directly to the back of the router first, then place in remote locations...

If you happend to have a managed switch, just be sure to disable any and ALL IGMP protcols as users have mentioned this has helped on there managed switches to get Orbi working correctly. 

 

https://community.netgear.com/t5/Orbi/Looking-for-a-select-group-of-Orbi-Community-members-that-are/...

 


@RatChickens wrote:
None of this setup mentions Ethernet. When setting up Ethernet do you power everything up and get it working wirelessly then plug in Ethernet?

How do I get access to the Beta Firmware?

The central switch being used is a Netgear GS316. This is the main switch being used for backhaul. I also have a TPLink TL-SG108, and 2x TL-SG105. These distribute Ethernet in various rooms.


 

My Setup (Cable 1Gbps/50Mbps)>CAX80 v2.1.2.1(LAG Disabled)>RBK853 v4.6.3.16
Additional NG HW: C7800/CM1100/CM1200CM2000, Orbi CBK40, CBR750, RBK50(v22), SXR30(v110), R7000(v34), R7800(v84), R7960P(v82), EX7500/EX7700, XR450(v120) and WNHDE111
Message 10 of 16
RatChickens
Tutor

Re: Satellite starts DoS Attack: ARP Attack when connected to Ethernet

The orbi satellite is connected through Netgear switch, but for some reason unplugging the TP-Link switches, setting up the satellite and then plugging the switches back in worked. Now I have Ethernet backhaul working on one satellite. I’ll try this process later on the other one.
Message 11 of 16
FURRYe38
Guru

Re: Satellite starts DoS Attack: ARP Attack when connected to Ethernet

Ok, let us know how it goes. Wondering about your switches. Hopefully it will all work out. 


@RatChickens wrote:
The orbi satellite is connected through Netgear switch, but for some reason unplugging the TP-Link switches, setting up the satellite and then plugging the switches back in worked. Now I have Ethernet backhaul working on one satellite. I’ll try this process later on the other one.

 

My Setup (Cable 1Gbps/50Mbps)>CAX80 v2.1.2.1(LAG Disabled)>RBK853 v4.6.3.16
Additional NG HW: C7800/CM1100/CM1200CM2000, Orbi CBK40, CBR750, RBK50(v22), SXR30(v110), R7000(v34), R7800(v84), R7960P(v82), EX7500/EX7700, XR450(v120) and WNHDE111
Message 12 of 16
RatChickens
Tutor

Re: Satellite starts DoS Attack: ARP Attack when connected to Ethernet

Unplugging the TPLink switches while connecting the satellites worked! After verifying the network was happy I plugged the switches back in and everything works.

Thanks for the help!

View solution in original post

Message 13 of 16
FURRYe38
Guru

Re: Satellite starts DoS Attack: ARP Attack when connected to Ethernet

Ok, Some switchay may need that as to update there MAC address table. 

 

Enjoy. 


@RatChickens wrote:
Unplugging the TPLink switches while connecting the satellites worked! After verifying the network was happy I plugged the switches back in and everything works.

Thanks for the help!

 

My Setup (Cable 1Gbps/50Mbps)>CAX80 v2.1.2.1(LAG Disabled)>RBK853 v4.6.3.16
Additional NG HW: C7800/CM1100/CM1200CM2000, Orbi CBK40, CBR750, RBK50(v22), SXR30(v110), R7000(v34), R7800(v84), R7960P(v82), EX7500/EX7700, XR450(v120) and WNHDE111
Message 14 of 16
Edgar_dc
Initiate

Re: Satellite starts DoS Attack: ARP Attack when connected to Ethernet

**Update:

Updated to the new firmware V2.2.1.210 and it is working ok for a couple of days now. Also, after updating and testing them (Router and Sat), I plugged my NetGear ProSafe GS108E and disable IGMP on it (saw a recommendation on the thread). I also have a Disney Circle, Synology NAS, Xbox, etc.

 

 

We will see how it goes...

Message 15 of 16
FURRYe38
Guru

Re: Satellite starts DoS Attack: ARP Attack when connected to Ethernet

Hope it works better for you. Smiley Wink

My Setup (Cable 1Gbps/50Mbps)>CAX80 v2.1.2.1(LAG Disabled)>RBK853 v4.6.3.16
Additional NG HW: C7800/CM1100/CM1200CM2000, Orbi CBK40, CBR750, RBK50(v22), SXR30(v110), R7000(v34), R7800(v84), R7960P(v82), EX7500/EX7700, XR450(v120) and WNHDE111
Message 16 of 16
Top Contributors
Discussion stats
  • 15 replies
  • 5801 views
  • 3 kudos
  • 5 in conversation
Announcements