Smart ARP

Find the answers to Adaptive Defense and Endpoint Protection queries in this forum. The experts will help you out!
Post Reply
StarshipUK
Registered user
Registered user
Posts: 1
Joined: Mon, 19 Feb 2018, 00:12

Smart ARP

Post by StarshipUK »

I am getting these come up on a Windows Server 2016:

Intrusion type:Smart ARP
Local IP:0.0.0.0
Remote IP:0.0.0.0
Remote MAC:94-9a-a9-c2-8b-54
Local port:0
Remote port:0
Number of detections:48
Action:Blocked
Detected by:Firewall protection

I ran a full scan and it found nothing. Does anyone know if I need to add an exclusion to stop these showing (I am guessing these are safe and its a false positive!)
Darth Panda
Official moderator
Official moderator
Posts: 1568
Joined: Tue, 24 Oct 2017, 12:04

Re: Smart ARP

Post by Darth Panda »

Hi,

The appliance with the MAC 94-9a-a9-c2-8b-54 probably have been sent malformed paquets that the firewall block (probably printer, scanner, router etc..)

Basically any appliance building up an ARP table. Check who is the owner for the MAC.

Regards
Technical support – Panda Security
www.pandasecurity.com
Post Reply

Return to “Adaptive Defense and Endpoint Protection - Issues”