My ISP uses static IPs (IPv4) for providing an Ethernet connection. Now recently I have been witnessing a serious drop of speed sometimes. I called my ISP to verify if there were any problems in the network, which they always tell me if fine on their side. The ping to Google DNS is always fine ie.
ping 220.127.116.11 -t
Now I think I am being spoofed because of two reasons. This is a local area broadband connection that I am using, ie. my neighbors are using the Ethernet from the same switch that is placed outside. even the IPs assigned are sequential. My IP is 172.16.130.196 my neighbors maybe 172.16.130.198 or something like that. So(correct me if I am wrong) you could do a scan of the IPs available in the network using something like AngryIPScanner.
The second reason why I think I am being ARP spoofed is because when I run the command arp -a in my Windows terminal I get multiple entries-: like so-:
Interface: 172.16.130.196 --- 0x4 Internet Address Physical Address Type 172.16.130.193 00-25-90-ea-31-33 dynamic 172.16.130.255 ff-ff-ff-ff-ff-ff static 18.104.22.168 01-00-5e-00-00-16 static 22.214.171.124 01-00-5e-00-00-fc static 126.96.36.199 01-00-5e-00-00-fd static 188.8.131.52 01-00-5e-7f-43-fa static 184.108.40.206 01-00-5e-7f-ff-fa static
The only entry that I recognize in this list is
172.16.130.193 which is my default gateway. What the hell are the others ? Is it okay for there to be multiple entries in the ARP cache ?
Am I a victim of ARP spoofing ? If so, how do I deal with it ie. can I ban the IP in my firewall or something ?
If any more evidence is required please let me know.