cancel
Showing results for 
Search instead for 
Did you mean: 

ARP: ARP Spoofing Detected

Hi:

I´m seeing a lot of events from "ARP: ARP Spoofing Detected". About 15,000 per month.

 

I downloaded tha packet capture to see the traffic related to this attacks. I only seen a normal ARP Request/ARP in my network. 

I read in the forum "ARP Mac Address Flip Flop" that someone solve one similar issue using the command arp delet <ip address>, and I whant know, How can I refresh all my arp table ?or if I can delete all my table with one comand and if it not afected my device.

1 Reply
Tsri
Level 7
Report Inappropriate Content
Message 2 of 2

Re: ARP: ARP Spoofing Detected

 

 

 Sensor remembers ARP and Reverse ARP (RARP) requests (for a specific time period), and matches an ARP reply with an ARP request message. Due to this ability, it can detect the following attacks:
  • ARP Spoofing Detected: If an ARP reply message is seen without a prior ARP request.
  • ARP Spoofing, Duplicate MAC: Detection of multiple ARP reply packets, with different sender MAC addresses for the same IP address that is being resolved.
  • MAC Address Cloned: Multiple and different replies to an RARP request; the exact opposite of 2.
The Sensor can also detect anomalous ARP reply packets, with a broadcast destination MAC address, and request or reply packets, with a broadcast sender addresses.
 
Refer KB55910 for more details
 
 
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community