Windows 10: I'd like to know how to block arp spoofing with Windows 10 firewall.

I'd like to know how to block arp spoofing with Windows 10 firewall. I don't use any other apps. The network configuration is LAN. The attacker is kali linux. Is there any way? thank you reply Plz

:)

 

Windows Firewall blocking websites

I have blocked IP addresses, e.g. 255.255.255.255, not URLs, e.g. somewebsite.co m.

As far as unblocking, look at your Windows Firewall rules. Do you see anything that is blocked? If you do, click on the Scope tab and see what is listed there.

 

Windows Firewall blocks App Store from downloading new apps

Hi,

Let's try to check if the app store you're referring to if it's really blocked by Windows Firewall. See these steps:

• Open Windows Firewall from the taskbar >
  Firewall & network protection > Allow an app through firewall.
• A new window will show up containing the list of the apps that ca be allowed through Firewall.
• Look for the app you want to be accessed, and make sure that the Domain, Private and Public are ticked. That would allow the app store to be accessed.

Let us know what happens after doing the suggestion.

 

Inexplainable (high) volume of ARP traffic

Hi all,

I’ve got an issue that I just can’t find the cause for but it’s related to network traffic.

Technicalities:

- Windows 10PC with latest creators Update

- Comodo Internet Security 10 (Firewall & AV)

- 2nd opinion scanner: Malwarebytes.

Problem:

Unexplainable network traffic since the latest Windows 10 creators update. My computer kept getting flagged by network administrators as it performed portscans…. I was puzzled so locked down the firewall to figure out what was going on. Comodo then
started to log The Windows Operating System doing an ARP where the source == destination. (No ports are logged)

By keeping anti-ARP spoofing on, the firewall managed to block this traffic.

From time to time however I go on another network where I need to disable this option and it happens that I forget to set it back on when on the other network – resulting in being flagged –again…

Last night I ran wireshark in order to try and figure out what was going on. I noticed that in just a few minutes thousands of ARP packages where found. Nearly all were legitimate and did a Broadcast. There were however some packages that weren’t that
clean…. I used the following filter based on my firewall log

arp and arp.dst.proto_ipv4 == 0.0.0.0 or arp and arp.dst.proto_ipv4 == 10.92.225.144





Results after filtering

ID time source destination protocol length info

6462 155.411233 Casa_88:11:1c Broadcast ARP 60 Who has 10.92.225.144? Tell 10.92.224.1

22734 735.111956 Apple_e7:00:ca Broadcast ARP 60 Who has 10.92.225.144? Tell 10.92.231.198

51439 1655.126182 Apple_e0:a3:4e Broadcast ARP 60 Who has 10.92.225.144? Tell 0.0.0.0

51452 1655.594252 Apple_e0:a3:4e Broadcast ARP 60 Who has 10.92.225.144? Tell 0.0.0.0

51468 1656.039489 Apple_e0:a3:4e Broadcast ARP 60 Who has 10.92.225.144? Tell 0.0.0.0

51473 1656.448602 Apple_e0:a3:4e Broadcast ARP 60 Gratuitous ARP for 10.92.225.144 (Request)

51488 1656.896077 Apple_e0:a3:4e Broadcast ARP 60 Gratuitous ARP for 10.92.225.144 (Request)

51503 1657.339227 Apple_e0:a3:4e Broadcast ARP 60 Gratuitous ARP for 10.92.225.144 (Request)



This is the firewall log for that night:

date application action direction protocol source ip source port dest. IP dest.IP

2017-05-22 00:38:24
Windows Operating System
Geblokkeerd
In
ARP
0.0.0.0

0.0.0.0


2017-05-22 00:37:39
Windows Operating System
Geblokkeerd
In
ARP
10.92.225.144

10.92.225.144


2017-05-22 00:36:37
Windows Operating System
Geblokkeerd
In
ARP
0.0.0.0

0.0.0.0


2017-05-22 00:23:04
Windows Operating System
Geblokkeerd
In
ARP
0.0.0.0

0.0.0.0


2017-05-22 00:09:28
Windows Operating System
Geblokkeerd
In
ARP
0.0.0.0

0.0.0.0




Does anyone know what causes this. I’ve already scanned the system with Malwarebytes and Hitman. System came out clean so I can’t believe it’s a virus. Is there some kind of configuration that got set to on by doing the creators update that I don’t
know about??

P.S. I know absolutely nothing about networking…