4

Wireshark detect highly suspicious network activity on my system. As you can see in the attached screen capture, broadcast traffic repeatedly sends weird packet information and suspicious requests, such as:

[TCP retransmission] [TCP spurious retransmission] [TCP fast retransmission] 443 > 449560 [RST, ACK] [TCP out-of-order]

enter image description here

enter image description here

In addition to Wireshark, I installed xARP software, and it consistently sends me alerts regarding potential ARP attacks, like:

"DirectedRequestFilter: targeted request. destination mac of arp request not set to broadcast/invalid address"

I am new to Wireshark. Could anyone help me to decipher this traffic activity and tell me if it's indication of ARP spoofing attack? And, what can I do to prevent it?

closed as unclear what you're asking by schroeder Feb 20 '18 at 10:45

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 7
    Neither of the screenshots you posted show any ARP packets... – tlng05 Aug 7 '16 at 14:31
  • This looks rather like so called lag e.g. slow networks. – Aria Aug 7 '16 at 16:02