Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My PC access internet is very slow and I find the router info is very strange:

The DHCP clients,

1   pc-PC                      E8-11-32-8C-0C-3A   192.168.1.110   01:53:11
2   WIN7U-20130403J            14-DA-E9-5D-BB-A1   192.168.1.103   01:49:11
3   android-205cdf15db0e729d   AC-F7-F3-E1-AC-C8   192.168.1.120   01:43:21
4   iPhone                     88-CB-87-43-00-C7   192.168.1.107   01:41:34
5   2011-20120818QR            90-E6-BA-19-F0-B0   192.168.1.106   01:32:57
6   user-THINK                 60-EB-69-BF-B4-5B   192.168.1.102   01:23:46
7   android-554bf2d5fd8ce1e3   60-21-C0-FE-8D-78   192.168.1.112   01:18:36
8   DIR-600M                   84-C9-B2-2D-1C-B2   192.168.1.100   01:01:08
9   WIN7U-20130403J            74-2F-68-54-97-A8   192.168.1.101   00:42:54

The ARP maps,

1   14-DA-E9-5D-BB-A3   192.168.1.100
2   60-EB-69-BF-B4-5B   192.168.1.102
3   14-DA-E9-5D-BB-A1   192.168.1.103
4   14-DA-E9-5D-BB-A3   192.168.1.106
5   14-DA-E9-5D-BB-A3   192.168.1.107
6   14-DA-E9-5D-BB-A3   192.168.1.110
7   14-DA-E9-5D-BB-A3   192.168.1.112
8   14-DA-E9-5D-BB-A3   192.168.1.120
9   14-DA-E9-5D-BB-A3   192.168.1.253

Almost all of MACs are same, what is wrong?

Above info is from router manager which can be logged in via http://192.168.1.1/, all of PCs listed above connect to this router which connect to WAN via PPPoE.

share|improve this question

migrated from security.stackexchange.com Sep 11 '13 at 23:07

This question came from our site for Information security professionals.

    
This question is missing some critical details like a thorough description of the layout of your network and particulars about where the system from which the ARP table was pulled is located in the network. –  Iszi Sep 11 '13 at 15:23
    
You also need to include the make and model of your router. –  druciferre Sep 11 '13 at 23:13
    
If it helps, the device belonging to MAC address 14-DA-E9-5D-BB-A3 is an ASUS device, which I'm betting is probably your router. –  druciferre Sep 11 '13 at 23:15
    
He might have posted this question to security because he thinks that his network is under attack. In fact, this looks like an ARP Poisoning or ARP Spoofing attack (assuming, "connect to this router" means, that all of his devices are connected directly to the router via LAN or WLAN without any switches or so in between) –  wullxz Sep 12 '13 at 0:52

1 Answer 1

You might be affected by an ARP Spoofing attack (see http://securityxploded.com/art-of-arp-spoofing.php for a detailed description). To check that, take on of the devices that seems to have the same MAC like almost all other devices. Look for your routers IP in its ARP table and compare if it's the same MAC like the one the router has stored in its ARP table for that device. If they're the same, somebody tries to do a man in the middle attack via ARP Spoofing.

Provide us more information about the used router and devices to check for anti ARP Spoofing actions. (A quick help is to restart the router and try to quickly change the password of both, the web interface and the WLAN security key. Maybe the attacker got into your network by cracking your WLAN security key).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.