Endpoint Protection

 View Only

  • 1.  ARP Mac Spoofing alerts generated continuously from endpoints

    Posted Jun 24, 2018 07:33 AM
      |   view attached

    We have upgraded the Clients from SEP 12.1.MP9 to SEP 14.

    Contioounsly every 10-15 minutes we get

     

    Unsolicited incoming ARP reply detected, this is a kind of MAC spoofing that may consequently do harm to your computer. Packet data is shown in the right window

    We insattled Wireshark on  the machine and noticed that for every ARP Inbound request , there is a definite Outbound reply. yet this issue seems occuring since months now

     

    The request is between the endpoint machine and router 

     

    We have machines from multiple site, with their respctive routers, giving alerts

     

    We have around 50,000+ alerts

    Support asked to enable ANti-Mac Spoofy but still the same error persists.

     

     



  • 2.  RE: ARP Mac Spoofing alerts generated continuously from endpoints

    Posted Jun 24, 2018 07:38 AM

    To what exact version of SEP 14 were they upgraded?



  • 3.  RE: ARP Mac Spoofing alerts generated continuously from endpoints

    Posted Jun 25, 2018 01:03 AM

    SEP 14. 1 MP2



  • 4.  RE: ARP Mac Spoofing alerts generated continuously from endpoints

    Posted Jun 25, 2018 05:27 AM

    please help to proceed further. Support doesnt seem to help



  • 5.  RE: ARP Mac Spoofing alerts generated continuously from endpoints

    Posted Jun 25, 2018 06:44 AM

    Upgrade to SEP 14.2, if that doesn't help then open a support case. If this is due to a code chane then only Symantec can fix it.



  • 6.  RE: ARP Mac Spoofing alerts generated continuously from endpoints

    Posted Jun 25, 2018 10:29 AM

    Hello, 

    I noticed the same after upgrade to 14.2. Did somebody open a support case?

    thanks

     

    Rudolf

     



  • 7.  RE: ARP Mac Spoofing alerts generated continuously from endpoints

    Posted Jul 12, 2018 06:14 AM

    I have opened a support case and provided the Wireshark Logs.

    Symantec is still investgating into it 



  • 8.  RE: ARP Mac Spoofing alerts generated continuously from endpoints

    Posted Sep 07, 2018 12:50 PM

    Can you share the resolution please? My 14.2 Windows 7 users are experinecing the samething. How do I turn the notifications off?



  • 9.  RE: ARP Mac Spoofing alerts generated continuously from endpoints

    Posted Sep 07, 2018 01:30 PM

    Did they ever provide a resolution?



  • 10.  RE: ARP Mac Spoofing alerts generated continuously from endpoints

    Posted Sep 11, 2018 10:56 AM

    I have an end user generating the same alerts every 20 minutes....Has Symantec figured this out yet? User is on a MAC laptop. Running the latest SEP 14.2

    Thanks



  • 11.  RE: ARP Mac Spoofing alerts generated continuously from endpoints

    Posted Feb 08, 2019 06:53 AM

    We are on 14.2 MP1 and still experiencing these alerts  - fine - log them, but please stop putting a pop-up on all my users' machines.  Telling them to ignore a security warning is bad all the way around - if they get a legitimate warning, they'll ignore that too.