title: ESET - ARP Cache Poisoning and Identical IP in network
body: <p>My ESET SS5 Firewall kept detecting Identical IP address and ARP cache poisoning attack frequently (every 2 mins) from past 24 hours</p>
  
  <p>I did some research on ARP cache poisoning attack, like how it can be used as MiM and using it as default gateway</p>
  
  <p>So I intalled Wireshark and started capturing the network... 90% of the captured records are ARP broadcast packets from different sources to different destination. I learned(from a computer networks textbook) that modern ISP dont allow broadcast of packets, but interestingly 90% of the captured records are ARP packets.  Moreover 'Default Gateway' is generally the router/switch in the LAN, then in that case why is that different computers asking for different IP address' to respond with their MAC address' ??</p>
  
  <p>If this was a networked area(a company) having network printer, then broadcasting and asking for who has this IP by ARP request might be reasonable. But in this case why will some one need a specific IP address unless its for some spoofing/hacking purpose.</p>
  
  <p>These are the points that kept bugging me..Below are the questions </p>
  
  <ol>
  <li>Will ISP's allow broadcast of ARP packets ??</li>
  <li>Are the IP address that are ARP requesting other IP's in the LAN(same subnet 183.82.xx.xx ) be infected with a virus which is causing this ??</li>
  <li>If there isnt a firewall, what can be the outcome?? - // Though lame but wanted to know</li>
  </ol>
  
  <p>My knowledge about networking and hacking is half baked(still in the process of learning).</p>