Mac Spoofing - ARP msg

diP · 27-02-2006, 11:19

Got this message from Sygate:

========

Unsolicited incoming ARP reply detected, this is a kind of MAC spoofing that may consequently do harm to your computer.

Packet data is shown in the right window.

Data Packet:

0000: 00 C0 9F 20 CA 6A 00 12 : 3F 68 46 FE 08 06 00 01 | ... .j..?hF.....
0010: 08 00 06 04 00 02 00 12 : 3F 68 46 FF 9E 26 8C 17 | ........?hF..&..
0020: 00 C0 9F 20 CA 6A 9E 26 : 8D 6F 00 00 00 00 00 00 | ... .j.&.o......
0030: 00 00 00 00 00 00 00 00 : 00 00 00 00 00 00 00 00 | ................

====

Can anyone tell me what this means?
Read a thread below regarding almost same ARP msg from Sygate and there it was just a timeout to the gateway. Is this the same or is it something else? Getting this msg within 10m intervalls...

Gareth · 27-02-2006, 11:26

There's an xeplanation of why Sygate flags this on their website...

Quote:

Originally Posted by Sygate

By default, this option is disabled and cannot be changed in the Standard version, and is enabled and changeable in the Pro version of the Personal Firewall. Some hackers use MAC spoofing to attempt to hijack a communication session between two computers in order to hack one of the machines. MAC (media access control) addresses are hardware addresses that identify computers, servers, routers, etc. When Computer A wishes to communicate with Computer B, it may send an ARP (Address Resolution Protocol) packet to the computer.

The anti-MAC spoofing feature allows incoming and outgoing ARP traffic only if an ARP request was made to that specific host. It blocks all other unexpected ARP traffic and logs it in the security log.

Personally, I wouldn't put too much emphasis on it, and as your firewall is blocking it, I'd just ignore it.

---------- Post added at 11:26 ---------- Previous post was at 11:26 ----------

ps -

to CF

diP · 27-02-2006, 11:40

Quote:

Originally Posted by Gareth

There's an xeplanation of why Sygate flags this on their website... Personally, I wouldn't put too much emphasis on it, and as your firewall is blocking it, I'd just ignore it.

---------- Post added at 11:26 ---------- Previous post was at 11:26 ----------

ps -

to CF

Ok.. thx for the tip