Tons of Smart ARP Blocked in 24H

Panda_BDPanda_BD
in Panda Adaptive Defense/Endpoint Protection

Hi,
I am facing problem with a client with tons of Smart ARP attack 976,772 times in the last 24h. Can you help me find the issue and resolve it.

Comments

  • David_David_ WatchGuard Representative

    Hello, Panda_BD

    on the online console, open one of the detection lines. and check the origin MAC address.
    check the IP assign to that MAC, by opening a MSdos console and executing the command:
    ARP -a
    That will give you the IP (all devices should be turned on and also part of the network, otherwise the IP will not be provided).
    Now you know if the origin IP is on your network, check why is it sending ARP requests (Maybe the DC, or a network printer, or a program trying to create an ARP table...), and decide whether it is explainable or not.

    Kind regards,

    David

  • Yugal_RYugal_R

    Hello @David_ ,
    ive have the same issue , how can i whitelist or allow the mac address of the device being blocked?

    Thanks ,

Sign In to comment.