Hi @ikheetjeff 

Thanks for posting in our business forum.

ikheetjeff wrote

  @GRL Yeah, i see that also. But when you turn it on, it doesn't work. I did an ARP Spoof on my network and it doesn't nothing.

 

Anyone has more information about this? Is this a bug?

As you have verified it, then Wireshark and paste your results here which shows the router fails to perform its job.

Hi @YuriyB 

Thanks for posting in our business forum.

YuriyB wrote

  @Clive_A   

Omada er605 with firmware 2.2.6 Build 20241111 Rel.57697 doesnt detect any arp-attacks.

i can successfully assign any IP from IP-MAC Binding list for any device and it works like a charm.

 

as example no problem to assign 192.168.6.10 to any other device with different MAC  and it will work like native network device passing through all access control, policy routing and bandwitth control rules. 

 

 

on attacker device i successfully assigned IP that has IP-MAC binding in ARP defence: and it have access to network.

no arp-attack detected.

tell pls what wireshark log you wish to see?

 

 

Ends with CC:DC:3A is the device that has a 192.168.6.10 which has been taken by the entry in the ARP firewall. Right?

Filter with the ARP, and what does the router reply to the ARP?

Hi @YuriyB 

Thanks for posting in our business forum.

YuriyB wrote

  @Clive_A  Thanks for reply.

On  windows PC with mac(E0-D5-5E-CC-DC-3A) I assigned in windows network settings static IP 192.168.6.10

 

(192.168.6.10 is another device and it has entry in ER605 ARP IP-MAC Binding List AC-80-FB-65-90-A7)

wireshark log 192168610.pcapng attached

put in ethernet cable and heres screen: 

 

 

No messages in syslog.

 

so any schoolboy can change his IP and making IP groups with access control list or routing rules is is senseless  :(

 

This is expected behavior. You are required to enable permit the packet matching the IP-MAC Binding entries only. Or they will allow the packet forward.

With this option enabled, when receiving a packet, the router will check whether the IP address, MAC address and receiving interface match any of the IP-MAC Binding entries. Only the matched packets will be forwarded. This feature can be enabled only when ARP Spoofing Defense is enabled.

Hi @YuriyB 

Thanks for posting in our business forum.

YuriyB wrote

  @Clive_A Okay, now it looks like this:

 

 

Router tells me about suspected attack. but why it is telling arp to attacker device?

 

now get foreigh device, set sny IP from ARP MAC-bindig list and watching wideos from my ip cameras on foreign device. 

can access all my network devices also.

I can understand purpose of ARP-Spoofing defence?

why on tplink archer ax23 or archer c64 devices NOT from ip-mac binding list or changing IP as i did, cant access to network but er605  does?

What indicates that the router is telling the attacker device? I don't see how you verified this.

sny?? What?

I don't understand the rest of the description. Try to use some grammar tools to address it. It does not accurately speak what you want to say.