My ISP uses static IPs (IPv4) for providing an Ethernet connection. Now recently I have been witnessing a serious drop of speed sometimes. I called my ISP to verify if there were any problems in the network, which they always tell me if fine on their side. The ping to Google DNS is always fine ie. ping -t

Now I think I am being spoofed because of two reasons. This is a local area broadband connection that I am using, ie. my neighbors are using the Ethernet from the same switch that is placed outside. even the IPs assigned are sequential. My IP is my neighbors maybe or something like that. So(correct me if I am wrong) you could do a scan of the IPs available in the network using something like AngryIPScanner.

The second reason why I think I am being ARP spoofed is because when I run the command arp -a in my Windows terminal I get multiple entries-: like so-:

arp -a

Interface: --- 0x4
  Internet Address      Physical Address      Type        00-25-90-ea-31-33     dynamic        ff-ff-ff-ff-ff-ff     static            01-00-5e-00-00-16     static           01-00-5e-00-00-fc     static           01-00-5e-00-00-fd     static        01-00-5e-7f-43-fa     static       01-00-5e-7f-ff-fa     static

The only entry that I recognize in this list is which is my default gateway. What the hell are the others ? Is it okay for there to be multiple entries in the ARP cache ?

Am I a victim of ARP spoofing ? If so, how do I deal with it ie. can I ban the IP in my firewall or something ?

If any more evidence is required please let me know.

  • Youre sharing a broadband connection (cable/dsl modem) with your neighbor? Next time it slows to a crawl, ask them to stop using bittorrent. Those other IPs are multicast (not real hosts) so they are not a symptom of ARP spoofing.
    – Jeff Meden
    Commented May 13, 2016 at 13:24
  • @JeffMeden Sharing means that the switch our Ethernet cables connected to is common.
    – Heidi
    Commented May 13, 2016 at 13:46
  • i can recommend a tool which will give you confidence: arpwatch
    – Gewure
    Commented Aug 3, 2017 at 14:35

2 Answers 2


There is no indication of ARP spoofing, at least not in the information you have provided. What you should see in case of ARP spoofing is that your default gateway has the wrong MAC address, i.e. you would need to verify the MAC address in this entry:        00-25-90-ea-31-33     dynamic

Everything else are all perfectly valid entries:            01-00-5e-00-00-16     static           01-00-5e-00-00-fc     static           01-00-5e-00-00-fd     static        01-00-5e-7f-43-fa     static       01-00-5e-7f-ff-fa     static

These are multicast addresses, not your neigbhors. From Wikipedia Multicast Address:

IPv4 multicast addresses are defined by the leading address bits of 1110, ... The group includes the addresses from to Address assignments from within this range are specified in RFC 5771...        ff-ff-ff-ff-ff-ff     static

And this is the broadcast address of your network


This looks perfectly fine. The addresses in your arp cache are for broadcast ( and various multicast groups. This is normal.

When you are the victim of ARP-Cache poisoning there are no additional addresses in that table. But the MAC address of your router would typically not match the real MAC address of the router.

You can verify this by running wireshark and filter for arp packets. If you are spoofed there will be a high frequency of ARP Packets with spoofed information in it.

  • I don't have a router. So should that mean that I am safe ?
    – Heidi
    Commented May 13, 2016 at 13:45
  • At some point you are using a router! You maybe don't own one but at least your ISP does so of cause you are in danger,...
    – davidb
    Commented May 13, 2016 at 14:06
  • Not necessarily. Many networks do not use routers at all, only switches. Commented May 13, 2016 at 15:22
  • 1
    @TylerDurden: a router is needed to access different networks (this is routing not switching), so usually you need a router to access the internet. In this case the default gateway is the router, i.e. the one which knows how to send packets to other networks. Commented May 13, 2016 at 17:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .