Hello good people, I have a question relating to a continual blocked ARP action.
The issue at hand here is on a home network. Most of the pc’s and devices on the network have reserved ip’s. One of those machines in particular with CIS 6.3.3 etc. installed continually shows firewall alerts of (Application / Windows Operating System > Action / Blocked > Target / In > Protocol / ARP > Source IP /192.168.xxx.xxx > Source Port / {blank} > Destination IP / {same as Source} > Destination Port / {Blank}.
The IP being blocked is another machine being assigned an IP by DHCP. Typically, I will notice this alert when another DHCP pc or device is turned on to connect to the network. However, no other machines in the home would have been starting up to start a session at the time, but some were in sleep / hibernate mode. I did however notice an abundance of these firewall blocking logs for this particular DHCP IP every few seconds after the modem and router were reset.
My feeling is, a machine on the network is sending an ARP request to itself when it is started or when the network is reset, but my question is why would CIS on another machine see this and block it?
Modify: I should have just posted the pic earlier see attached.
Also, if a pc’s mac was cloned to a router during initial network setup, would other devices on the network then look to that pc’s mac as the gateway instead of the routers mac?
UPDATE 2/1/2014 - After a few days of troubleshooting, I am finding machine (A) will receive and block ARP requests for the following…
1) Repeatedly block ARP request [every few seconds] from windows machine (B) whenever it starts / machine (B) has assigned ip address, and is reserved on router (within DHCP range).
2) Repeatedly block ARP request [every few seconds] from iphone device (C) whenever it starts / iphone device (C) does not have assigned ip nor a reserved ip on router.
3) Block ARP request[once] from xbox device (D) whenever it starts / xbox device has assigned ip address and is reserved on router (within DHCP range).
4) Block ARP request [once] from xbox device (E) whenever it starts / xbox device has assigned ip address and is reserved on router (within DHCP range).
Machine (A) [does not] receive ARP request from machines (F), (G), (H) which all have assigned ip addresses and are reserved on the router (within DHCP range) / These machines have XP OS while machines (A), (B), (C), (D), (E) do not.
Machine (A) [does not] receive ARP request from Android devices (I), (J) which have reserved ip’s (within DHCP range) on the router which ultimately assigns these address to the Android devices.
[attachment deleted by admin]