ARP cache trashing?

General Discussion (off topic) Anything and everyt
#1

This has been resolved. Nothing to see in here.

Taking a look at the firewall log I see two entries:

20150626 9:39.14am Windows Operating System Blocked In ARP x.y.52.158 x.y.52.158
20150626 9:39.13am Windows Operating System Blocked In ARP x.y.79.65 x.y.79.65

I have anti-ARP spoofing enabled (hence the Blocked above). The part I don’t get is the IP addresses. They’re not part of my network. At the moment I have a DSL modem at x.y.52.152 and a XP box at 192.168.2.12.

Was this an attempt to trash my ARP cache (which CIS caught)?

#2

Make it a habit of clearing the mapped addresses in the cache. Run CMD as admin and type arp -d -a

To view the store type arp -a. If it’s not empty (except for your interface) after the the first command then there is a problem.

#3

I’ve been checking the cache several times through the day. Other than the log entries above there hasn’t been a problem.

Thanks,
Bob