Selecting "Enable Anti-ARP spoofing" Blocks Entire Internet [M1219]

Comodo Internet Security - CIS Resolved/Outdated Issues - CIS
21

Find the answer in the view logs. The screenshot.

https://yadi.sk/i/PTMp5JhOc5kXp

22

The devs have not marked this as Fixed in the tracker. However, sometimes bugs are fixed by the release of new versions, but not marked as Fixed in the tracker.

If you are able please check with the newest version (CIS version 8.0.0.4337) and let me know if this is fixed on your computer with that version.

Thank you.

23

Hi Chiron,

I am not a user anymore. Sorry I can’t check this.

Regards,
yigido

24

I’m very sorry to hear that. If in the future you, or anyone else, is able to check this issue please respond and let me know.

Also, yigido, even though you are not a CIS user anymore, please do feel free to still ask any questions you may have.

Thanks.

25

Hi Chiron,

I installed CIS today. This problem still exist. CIS when Anti-ARP Spoofing enabling, blocks my entire connection.

What can I do now?
Thanks

26

I’ve updated the tracker data.
Could you post your FW logs (while you’re experimenting this issue, recommended after you cleared the logs initially)?

Thank you.

27

How can I do this? Can you explain me :slight_smile:

28

[ol]- Open CIS, go to Tasks and choose View Logs

  • You may want to clear your logs and then re-do the experimenting with the ARP setting so that old irrelevant log content is removed.
  • Choose Firewall Events in the drop-down menu.
  • [Optional] Right-click anywhere and click Entire Period and then press Date two times so that it is in a order of time with the latest events at the top.
  • Right-Click anywhere and then click Export
  • Type in a name and save the file to any location you want.
  • Attach the file in a reply to this thread.[/ol]
29

Hi @Sanya thanks for your help :slight_smile:
but there is nothing I saw in the firewall logs.
I will attach it anyway.

[attachment deleted by admin]

30

I just checked it and it is indeed empty. (Just wondering, did you choose “Entire Period” under the optional instructions of point #4?)

31

I did all steps, do not worry. If you wants to see which connections blocked by CFW. There is no block for the sites.
Enabling Anti-ARP spoofing is blocks my entire (whole) connection. When I disabled it, the pages automatically loaded.

32

We are mainly looking for FW events triggered by the operating system and relations between Source IP and Destination IP (ARP protocol).

33

I am sorry for my late , and I do not reproduce your problem.
My enviroment and steps are same with you ,expect for Windows 7 Ultimate x64 . Now I am begining to download Windows 7 Home Premium with Service Pack 1 (x64) system for test ,but differences is very small between these two systems ,We will make our efforts for reproducing your problem 。
I find your network is wireless (I test on wired network and wireless network), did you test this issue using wired network or would you reproduce it on virtual machine ?
Thanks for your feedback and Looking forward to your reply。

34

This is my dormitory internet… Problem is only exist this dormitory internet.
When I am at my friend home, problem dissapeared… I think problem is not CIS, the problem is my network.
You can move the topic as resolved issue.
Thanks

35

if the reason is your network,then your network is attacked by ARP spoofing at the time when your mac cache is timeout. Because cis donot know the mac of gateway and the attacked arp is droped .leding to that system donot know gateway mac， so there is no net package.

you can call the cmd.exe ,arp -d,and ping the ip of gateway or router to get correct mac or the mac of attacker .then arp -a ,and find who the mac come from . or you can use wireshark to filter arp .
I donot know if it is useful for your network . good luck!

36

There is a contradiction between these statements. Thus, the issue should not be marked as “Resolved”.

37

if you also reproduce , you can try bind the ip of gateway with mac of gateway by follow:
1 netsh i i show in
2 find your the index of local network ,eg 12
3 netsh -c “i i” add neighbors 12 192.168.1.1 00-23-cd-a4-b3-ce , 192.168.1.1 is instead of the ip of gateway, 00-23-cd-a4-b3-ce is instead of the mac of gateway。
4 enable network card (wired network) to promiscuous mode

you repeat the steps before now to see if it also happens and capture packet by wireshark from begin to end ,then you save the packtets to a local file . check if it is same ,when turn on wireshark and turn off wireshark,because attacker maybe force network card to drop the packet,we will force network to receive the droped packet when turn on promiscuous mode.

I am looking forward to your reply and hope to get your wireshark local file .thank you !

38

Hello,

The devs have not marked this as Fixed in the tracker. However, sometimes bugs are fixed by the release of new versions, but not marked as Fixed in the tracker.

If you are able please check with the newest version (CIS version 8.1.0.4426) and let me know if this is fixed on your computer with that version.

Thank you.

39

Hello,

Today I tested new Beta of CIS 8.2.0.4474… and problem still exist in this beta.
Symptoms are same as the first post. You can see the problem in to the video which attached in the first post.
I attached new diagnostic report and some other needed files. I also attached “Firewall Pro” folder into ProgramData path of CIS.

Inform to you mods and devs
Regards,
yigido

[attachment deleted by admin]

40

I almost forgot…
This issue only happens when I am online on my dormitory internet connection…
While I am connected to my mobile hotspot connection the problem is not happen…

It is clear that there is a problem between my dormitory internet and CIS.

Thanks,
yigido