3

Don't know that Am I really under this attack or not, eSet (ESS 5.0) several times is reporting this to me.

What I should mention are :

  1. Here are using a Wireless point-to-point to get Internet to our tower, Then with a DSLAM the internet is provided to our room.

  2. Some times I'm using a VPN, Don't know could the providers Do attacks or not.

  3. The reported IPs I saw 192.168.1.1 and 192.168.1.4

  4. There are 2-3 home devices Using this wireless internet and PC using it from a LAN

  5. There is a wireless printer which is one of the things I have doubt causes the problem.

  6. Here the room is using a TP-Link 8901G ( Whireless ADSL 2+ Router, Modem & Accesspoint )

Q) Am I under attack or this could be just some IP conflicts ? If so How to Prevent or resolve this issue ?

* Which logs is needed tell me to upload and provide a link

Kasrak
  • 133
  • 6

1 Answers1

1

I found it difficult to understand the exact architecture of your network, so im trying to give somewhat a generic answer for your problem:

To make sure if you are being attacked or not, run the arp -a command from one of your computers while ESET alarms you. This command will dump all the ARP records of the computer to the screen. Check against the other machines if their MAC addresses are correct (specially against the router, or the other computer in the ptp connection). Do this in windows using the command ipconfig /all and in *nix systems using the command ifconfig. If so, there is no risk of ARP spoofing attack, or ESET succeeded in stopping it.

If you want to understand the source of ESETs notification try running Wireshark and write arp in the filter box at the top. Show the result to any IT pro and ask him if he/she find it suspicious or not, they should know...

Boaz Tirosh
  • 633
  • 2
  • 7
  • 18
  • Dude I think you put me in a right direction, could you give help on the logs ? also want to know how could I find the mac address of my printer ? – Kasrak Sep 09 '12 at 09:37
  • 1
    Usually the mac address will be written on the printer (check the bottom of the printer). If you can't find it there, disconnect and connect the printer while wireshark is listening (its not the prettiest solution, but it will work and i don;t want to get you confused).

    Note the address of the client trying to get IP from the router, this is your printer.

    about the logs, try contacting me on private or dump the logs to pastebin and write the URL to here. be careful with what you publish.

     – Boaz Tirosh Sep 09 '12 at 16:19
  • Thanks friend, At that moment I found an expert and analyzed the logs together and found this is a kind of IP conflict. – Kasrak Sep 24 '12 at 13:00