1

My ISP uses static IPs (IPv4) for providing an Ethernet connection. Now recently I have been witnessing a serious drop of speed sometimes. I called my ISP to verify if there were any problems in the network, which they always tell me if fine on their side. The ping to Google DNS is always fine ie. ping 8.8.8.8 -t

Now I think I am being spoofed because of two reasons. This is a local area broadband connection that I am using, ie. my neighbors are using the Ethernet from the same switch that is placed outside. even the IPs assigned are sequential. My IP is 172.16.130.196 my neighbors maybe 172.16.130.198 or something like that. So(correct me if I am wrong) you could do a scan of the IPs available in the network using something like AngryIPScanner.

The second reason why I think I am being ARP spoofed is because when I run the command arp -a in my Windows terminal I get multiple entries-: like so-:

arp -a

Interface: 172.16.130.196 --- 0x4
  Internet Address      Physical Address      Type
  172.16.130.193        00-25-90-ea-31-33     dynamic
  172.16.130.255        ff-ff-ff-ff-ff-ff     static
  224.0.0.22            01-00-5e-00-00-16     static
  224.0.0.252           01-00-5e-00-00-fc     static
  224.0.0.253           01-00-5e-00-00-fd     static
  239.255.67.250        01-00-5e-7f-43-fa     static
  239.255.255.250       01-00-5e-7f-ff-fa     static

The only entry that I recognize in this list is 172.16.130.193 which is my default gateway. What the hell are the others ? Is it okay for there to be multiple entries in the ARP cache ?

Am I a victim of ARP spoofing ? If so, how do I deal with it ie. can I ban the IP in my firewall or something ?

If any more evidence is required please let me know.

Improve this question
3
  • Youre sharing a broadband connection (cable/dsl modem) with your neighbor? Next time it slows to a crawl, ask them to stop using bittorrent. Those other IPs are multicast (not real hosts) so they are not a symptom of ARP spoofing.
    – Jeff Meden
    May 13, 2016 at 13:24
  • @JeffMeden Sharing means that the switch our Ethernet cables connected to is common.
    – Heidi
    May 13, 2016 at 13:46
  • i can recommend a tool which will give you confidence: arpwatch
    – Gewure
    Aug 3, 2017 at 14:35

2 Answers 2

Reset to default
6

There is no indication of ARP spoofing, at least not in the information you have provided. What you should see in case of ARP spoofing is that your default gateway has the wrong MAC address, i.e. you would need to verify the MAC address in this entry:

172.16.130.193        00-25-90-ea-31-33     dynamic

Everything else are all perfectly valid entries:

224.0.0.22            01-00-5e-00-00-16     static
224.0.0.252           01-00-5e-00-00-fc     static
224.0.0.253           01-00-5e-00-00-fd     static
239.255.67.250        01-00-5e-7f-43-fa     static
239.255.255.250       01-00-5e-7f-ff-fa     static

These are multicast addresses, not your neigbhors. From Wikipedia Multicast Address:

IPv4 multicast addresses are defined by the leading address bits of 1110, ... The group includes the addresses from 224.0.0.0 to 239.255.255.255. Address assignments from within this range are specified in RFC 5771...

172.16.130.255        ff-ff-ff-ff-ff-ff     static

And this is the broadcast address of your network

Improve this answer
2

This looks perfectly fine. The addresses in your arp cache are for broadcast (172.16.130.255) and various multicast groups. This is normal.

When you are the victim of ARP-Cache poisoning there are no additional addresses in that table. But the MAC address of your router would typically not match the real MAC address of the router.

You can verify this by running wireshark and filter for arp packets. If you are spoofed there will be a high frequency of ARP Packets with spoofed information in it.

Improve this answer
4
  • I don't have a router. So should that mean that I am safe ?
    – Heidi
    May 13, 2016 at 13:45
  • At some point you are using a router! You maybe don't own one but at least your ISP does so of cause you are in danger,...
    – davidb
    May 13, 2016 at 14:06
  • Not necessarily. Many networks do not use routers at all, only switches.
    – Tyler Durden
    May 13, 2016 at 15:22
  • 1
    @TylerDurden: a router is needed to access different networks (this is routing not switching), so usually you need a router to access the internet. In this case the default gateway 172.16.130.193 is the router, i.e. the one which knows how to send packets to other networks.
    – Steffen Ullrich
    May 13, 2016 at 17:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .