Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My PC access internet is very slow and I find the router info is very strange:

The DHCP clients,

1   pc-PC                      E8-11-32-8C-0C-3A   01:53:11
2   WIN7U-20130403J            14-DA-E9-5D-BB-A1   01:49:11
3   android-205cdf15db0e729d   AC-F7-F3-E1-AC-C8   01:43:21
4   iPhone                     88-CB-87-43-00-C7   01:41:34
5   2011-20120818QR            90-E6-BA-19-F0-B0   01:32:57
6   user-THINK                 60-EB-69-BF-B4-5B   01:23:46
7   android-554bf2d5fd8ce1e3   60-21-C0-FE-8D-78   01:18:36
8   DIR-600M                   84-C9-B2-2D-1C-B2   01:01:08
9   WIN7U-20130403J            74-2F-68-54-97-A8   00:42:54

The ARP maps,

1   14-DA-E9-5D-BB-A3
2   60-EB-69-BF-B4-5B
3   14-DA-E9-5D-BB-A1
4   14-DA-E9-5D-BB-A3
5   14-DA-E9-5D-BB-A3
6   14-DA-E9-5D-BB-A3
7   14-DA-E9-5D-BB-A3
8   14-DA-E9-5D-BB-A3
9   14-DA-E9-5D-BB-A3

Almost all of MACs are same, what is wrong?

Above info is from router manager which can be logged in via, all of PCs listed above connect to this router which connect to WAN via PPPoE.

share|improve this question

migrated from Sep 11 '13 at 23:07

This question came from our site for information security professionals.

This question is missing some critical details like a thorough description of the layout of your network and particulars about where the system from which the ARP table was pulled is located in the network. – Iszi Sep 11 '13 at 15:23
You also need to include the make and model of your router. – druciferre Sep 11 '13 at 23:13
If it helps, the device belonging to MAC address 14-DA-E9-5D-BB-A3 is an ASUS device, which I'm betting is probably your router. – druciferre Sep 11 '13 at 23:15
He might have posted this question to security because he thinks that his network is under attack. In fact, this looks like an ARP Poisoning or ARP Spoofing attack (assuming, "connect to this router" means, that all of his devices are connected directly to the router via LAN or WLAN without any switches or so in between) – wullxz Sep 12 '13 at 0:52

You might be affected by an ARP Spoofing attack (see for a detailed description). To check that, take on of the devices that seems to have the same MAC like almost all other devices. Look for your routers IP in its ARP table and compare if it's the same MAC like the one the router has stored in its ARP table for that device. If they're the same, somebody tries to do a man in the middle attack via ARP Spoofing.

Provide us more information about the used router and devices to check for anti ARP Spoofing actions. (A quick help is to restart the router and try to quickly change the password of both, the web interface and the WLAN security key. Maybe the attacker got into your network by cracking your WLAN security key).

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .