Poisoning attack!!

gooner045

Hi
I am running ESET Smart Security and I checked my firewall logs last night and I was horrified to see it had detected around 40-50 arp cache poisoning attacks and 15 dns cache poisoning attacks in the last 6 weeks. I have run superantispyware and spybot and both came back clean. Is someone attempting to hack my computer? Both my lappy and main machine show the same thing about these attempts, at least they were thwarted by ESET.
Is this normal please ?
I live in a cul-de-sac, so I would know if someone was outside my house.
I have a high ranking Old Bill living next door, and we are on seperate sides of the fence concerning not only living arrangements but lifestyle as well !! ( cant say too much) and I'm concerned that something sinister is occuring here.
Can someone put my mind at ease please.
TIA

superscaper

gooner045 wrote: »

Hi
I am running ESET Smart Security and I checked my firewall logs last night and I was horrified to see it had detected around 40-50 arp cache poisoning attacks and 15 dns cache poisoning attacks in the last 6 weeks. I have run superantispyware and spybot and both came back clean. Is someone attempting to hack my computer? Both my lappy and main machine show the same thing about these attempts, at least they were thwarted by ESET.
Is this normal please ?
I live in a cul-de-sac, so I would know if someone was outside my house.
I have a high ranking Old Bill living next door, and we are on seperate sides of the fence concerning not only living arrangements but lifestyle as well !! ( cant say too much) and I'm concerned that something sinister is occuring here.
Can someone put my mind at ease please.
TIA

I'm afraid it's normal. That's not to say it's acceptable but it at least demonstrates why we should all have firewalls. I've just checked my log files for Eset Smart Security and it's an identical story to yours. So no need to get paranoid, you're not being specifically targetted. (Or if you are then we're in this mess together )

gooner045

Thanks Mate
I got eset after one of your posts recommended it, and I'm well impressed with it, it very rarely has anything to say for itself, which is a relief in my house!
You know why I'm paranoid, not that I'm up to anything sinister
It just made my stomach go over seeing all that red, like I said at least it stopped it !
Thanks again

fwor

To put your mind further at rest, I'm fairly certain that both ARP and DNS attacks are aimed at network infrastructure, not at end-user computers (the first targeting routers, and the second name servers).

IIRC they are broadcast, so in all probability everyone on your ISP's subnet will see exactly the same thing - they are not attacks on your IP address specifically.

[MaccA]

gooner,

arp and dns poisoning sounds worse than it is. These attacks are not trying to directly access your machine or install anything malicious. They are trying to change the "lookup" records your machine has for finding information on the network/internet. As a result they may make your computer visit a dangerous web site when you've actually asked it to go to Google. Your machine would then need to be open to whatever "hacks" the web site contains which, if you have a firewall and keep your machine updated from Microsoft, it probably isn't.

Is your PC connected directly to the internet via a USB Broadband modem or do you have one of these Broadband routers that people like Sky, BT, o2 give away? If it is the former then I can understand why you are seeing these attempts, but if it is the latter then these Poisoning attacks shouldn't be reaching your PC, as the router should be stopping them. If this is the case then it could be that you have faulty network hardware on your network or (more likely) that ESET is very sensitive and is reporting something which is just a "blip" in the network traffic.

Either way I wouldn't be worried.

[MaccA]

gooner045

Thanks for the help and putting my mind at rest.
Macca it's a d-link router and talktalk isp.
I read on the cain and abel website once about hacking and poisoning attacks, to hack someones wireless setup and it freaked me out a bit, at least I can stop looking out the window now hehe
Thanks again

superscaper

gooner045 wrote: »

Thanks for the help and putting my mind at rest.
Macca it's a d-link router and talktalk isp.
I read on the cain and abel website once about hacking and poisoning attacks, to hack someones wireless setup and it freaked me out a bit, at least I can stop looking out the window now hehe
Thanks again

Ahh well I'm on Talktalk too. :rotfl:

gooner045

superscaper wrote: »

Ahh well I'm on Talktalk too. :rotfl:

DAD is that you ???
:rotfl:;)

Millionaire

I have Eset Smart Security and I also noticed the DNS poisoning Attack logs in the firewall log file.

It seems like it picks these up for everyone. So I would not worry about it.

spaceman5

is this eset smart security a good program, i have noticed they make nod32, so is it a earlier version of this

superscaper

spaceman5 wrote: »

is this eset smart security a good program, i have noticed they make nod32, so is it a earlier version of this

No. They're both the same "age". NOD32 is the antivirus program. Smart Security is the entire security suite that includes the NOD32 AV engine as well as have a firewall, anti spyware and anti-spam.