Thursday, March 14, 2019

Weird ARP Attacks

We are having a weird problem with ARP on a particular VLAN

  • Many Macbooks in the network keeps broadcast them as Gateway MAC that cause other Windows clients on the network could not access network.

  • So far, only Windows clients received bad ARP.

  • On the network, we do setup dhcp snooping (Meraki at both layer 2 and layer 3)

  • I have checked the Macbooks that broadcast ARP, but could not find anything special on them

  • This is a wireless network with client isolation setup.

https://i.imgur.com/PKW0KX6.png

https://i.imgur.com/LJPArlJ.png

Do you have any recommendations or ideas ?

Thanks !



No comments:

Post a Comment