[CLOSED] I require some assistance

Container for RESOLVED incidents, queries SOLVED by the experts, EXPIRED topics or those that have been CLOSED by the users.
Locked
SV2S
Registered user
Registered user
Posts: 2
Joined: Tue, 08 Mar 2016, 18:27

[CLOSED] I require some assistance

Post by SV2S »

Hi Panda team,


I'm a fellow user and have been using panda premium for over a couple years, but since recently i have been getting some kind of Smart Arp attacks which are succesfully stopped. But i have been noticing my pc is getting slower having some framerate issues, which occur out of the blue even when im doing simple word and ppt actions.
I have the idea that not all attacks are being stopped because it are so many over 1k reports in a single month !
So how can i make my PC more secure so that the Smart arps 'can't reach me' so panda is not so busy doing the repelling.

I hope we can resolve this togethere and if the team requires more information about my specs etc please contact me


With kind regards,


SV2S
User avatar
GoneToPlaid
Registered user
Registered user
Posts: 56
Joined: Fri, 13 Jun 2014, 06:56

Re: I require some assistance

Post by GoneToPlaid »

Hello SV2S,

If you have an Internet router, then look at its log files and then block the incoming IP address listed in your router's log files. Alternatively, look in Panda's events for the IP address to block. In Panda's firewall, you can block a specific incoming IP address for all programs. This should put a stop to the Smart Arp attacks. Yet it would be better to block this incoming IP address in your Internet router. Or perhaps both.
SV2S
Registered user
Registered user
Posts: 2
Joined: Tue, 08 Mar 2016, 18:27

Re: I require some assistance

Post by SV2S »

GoneToPlaid wrote:Hello SV2S,

If you have an Internet router, then look at its log files and then block the incoming IP address listed in your router's log files. Alternatively, look in Panda's events for the IP address to block. In Panda's firewall, you can block a specific incoming IP address for all programs. This should put a stop to the Smart Arp attacks. Yet it would be better to block this incoming IP address in your Internet router. Or perhaps both.

Well im a big noob at this kind of things care to explain how i would do this


note: i dont have access to the router so i can only block the account from panda
User avatar
VirusBuster
Official moderator
Official moderator
Posts: 7595
Joined: Mon, 02 Apr 2012, 18:53
Location: Panda HQ - Bilbao

Re: I require some assistance

Post by VirusBuster »

Here is an explanation for the Smart ARP protection

Smart ARP is a protocol or application defense which is activated when the machine receives a response to an unsolicited packet or ARP protocol (address resolution protocol)
This avoids Man-In-The-Middle attacks in which an attacking user can modify the addresses and MACs table of the attacked machine, stating that the address of the trusted user is now, the attacking machine one (provided in that packet).

This attack can be triggered for any of the 4 causes described below depending if its in Broadcast (sending of packets to all the machines on the LAN) or not.

BROADCAST
1. Gratuitous Packet -> Source Address && Destination Address are equal.
2. Broadcast Reply -> Broadcast Reply Request without having performed ARP Request.
3. Broadcast Limit reached -> The configuration item NNS_CONFIG_IDS_ARP_MAX_BROADCAST_RCVD_PER_SECOND is greater than 20. Meaning that the machine received more than 20 ARP Broadcast packets in 1 second. Implies excessive traffic in LAN.

NO BROADCAST
1. Single packet dedicated received -> Destination MAC Address NOT NULL. The machine we have send the ARP Request to must have a valid MAC address in the MAC Destination filed of the ARP Reply packet.
Regards,

Image
Jorge Torre
TechSupport Department - Panda Security

I don't reply to private messages unless I have previously requested them
Locked

Return to “Virus - Archive Issues”