Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a small LAN in my home about 4 - 5 computers. The problem is that when there are usually 3 or more pc's online we keep losing the Internet access randomly about every 2 minutes.

So we took a look with the wireshark and it seems like my computer is infected with something that keeps asking my IP to modem. It is something called "Azurewav" (I don't have any hardware or software that is related to neither Azurewav nor Azurwave)

Although its not broadcasting all the time, the thing that its asking modem every second about my mac address seems to be the problem about our connection lost. I'm not very experienced about this but pushing too many requests to modem may cause this (if other computers are infected too) IMHO.

Here is a screenshot from wireshark. I've put the known IP's as static but it keeps continuing somehow.

I'm using Windows 7 - 64 bit Ultimate. And connecting through wireless.

wireshark capture

To sum up, my computer is doing some arp spoofing attacks without my will. How can I stop it? If it must be done with a software please share a free one. If it can be solved by deleting the malware by some scans or etc.. It would be much appreciated

share|improve this question
You can afford a W7-64 computer, but you can't afford decent antivirus software? (AzureWave is the brand of your wireless adapter, BTW.) – Daniel R Hicks Apr 25 '12 at 12:05
Yes about that, I'm a student so W7-64 comes free. Azurewave is not the brand I did have a look for it but I couldn't find anything related to that company. That's why I noted (I don't have any hardware or software that is related to neither Azurewav nor Azurwave). Thanks for the reply! – umutto Apr 25 '12 at 12:07
Odd, it was at the top of the list when I Googled it. They make wireless adapters for laptops. – Daniel R Hicks Apr 25 '12 at 12:08
Yes, I did & thought the exact same thing too but I couldn't even found their brand name on my hardware when I opened it up. The thing is if you search for "Azurewav" on google you can see some people also suffered. Maybe I accidentally installed their drivers? – umutto Apr 25 '12 at 12:11
Open Device Manager and look at your Network Adapters. What's your wireless (WIFI) adapter called? – Daniel R Hicks Apr 25 '12 at 12:11
up vote 3 down vote accepted

I don't see any sort of "spoofing" or "poisoning" here.

The first part consists entirely of query packets. Some routers periodically send ARP queries to the entire subnet in order to refresh their "Connected computers" list, but although I have never seen a Windows 7 computer do this, it isn't harmful by itself – unless it reaches thousands of requests per second; your capture only shows ~256 packets. Do check "Network Discovery" settings, though.

The second part is just normal ARP queries and replies. Your router is asking for your computer's address every 30 seconds, which is fairly normal for ARP – and the computer's replies contain legitimate information.

Azurewav stands for "AzureWave Technologies" according to /usr/share/wireshark/manuf. It manufactures Atheros WiFi adapters commonly found in laptops.

Note: ARP is not related to the "DHCP" vs "Static IP" setting; ARP requests will be sent in either case.

share|improve this answer
Thank you! Actually I've seen the first part only today, I thought it was interesting and wanted to share. Will check the "Network Discovery". And about the second part, I've checked with one of the other computers in my network and it didn't do that every 30sec or faster. So I was pretty sure it was ARP poisoning. Thanks for the info. So to sum up can we say I'm clean? – umutto Apr 25 '12 at 12:25
@umutto: The first part is rather unusual for me, but queries are definitely not harmful. How often are the mass-requests sent, though?) – grawity Apr 25 '12 at 12:30
Thank you for the answer again! I've changed my network discovery settings in anycase. First part was temporary I've been monitoring for 2days and its the first time I saw it, It was interesting so I put that also. Thank you! – umutto Apr 25 '12 at 12:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .