1

I am behind a Linksys router. I have my computer connected to the router via cable. I have a WPA2 security set up. I am on Win 7.

I have just been notified by Symantec antivirus with the following:

"Unsolicited incoming ARP reply detected, this is the kind of MAC spoofing that may consequently do harm to your computer. Packet data is shown in the right window."

The remote host behind the event is my local network IP 192.168.1.1. The remote MAC is my wireless network MAC adress. The local MAC is from the IP adress 192.168.1.100 which is listed as "unknown" in the DHCP list.

When I check my DHCP client list my "laptop" is under another MAC and behind IP 192.168.1.101. This is the list with wireless disabled.

Why am I seeing two IP adress' in the DHCP list when I have connected only one device (laptop) to my router and wireless disabled? Is this causing MAC spoofing?

Am I being hacked?

I did a full scan with Symantec and Malwarebytes and it came out clean.

I also get port scans approx. every minute from various IP's.

Thanks for the help.

Update: There is not much to post besides the information I've already given. There was an "unknown" client in my DHCP client list along with my "laptop" even though the laptop was the only device connected to the router. I checked the network traffic for the "unknown" MAC adress and there are about 30 logs of chrome and mdnsrespodner connections and a few blank ones.

I have reset my router, its password and the wireless name and its password. The "unknown" client is no longer listed in the DHCP list only my laptop is, as it should be. I limited my DHCP connections to just 1, for now.

I am still trying to understand what happened. I used my laptop through the wireless connection before I switched to plugging it via cable.

Could this have caused the router to keep displaying the old wireless connection as "unknown" once I switched to cable?

  • Is it possible you could post any logs you are seeing? – multithr3at3d Apr 28 '16 at 17:06
  • Please read my update. – Nakute Marato Apr 28 '16 at 17:53
  • Does the other MAC match the MAC of the wireless interface? – multithr3at3d Apr 29 '16 at 0:43
  • No it was a LAN interface and there was no expiration time. Thoughts? – Nakute Marato Apr 29 '16 at 5:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.