PDA

View Full Version : Detected DNS cache poisioning attack


dabanf
April 11th, 2009, 07:03 AM
Hi have started using wifi on my laptop and lone behold getting some weird entries in my "personal firewall log".

Basically have identified that the "source" of the DNS or ARP is coming from my ip address!!!!!!!!!!!!!!

Is there a setting in Eset SS that i need to setup to prevent this.

The attack is not being listed under "detected threats" but this morning i couldn't get online as my modem was kicking up a network error message stating "...DNSSpoofed&URL....."

What's the best way to deal with this bearing in mind i will continue to use wifi.

MTIA

funkydude
April 11th, 2009, 08:40 AM
Please make sure you're updated to 4.0.417.0

DarrenDavisLeeSome
April 11th, 2009, 12:11 PM
I've had the ARP/DNS Cache Poisoning Attacks detections ever since ESS 3.0.674 (?) that were coming from my router whenever I went to a secure log-on server primarily. Occasionally, I would get them from my ISP's DNS or from using their Chat Tech Support(https). Still getting these attacks with ESS 4.0.314~417.

Have you been doing the whois check bit with the IP address(es) to find out where these attacks are coming from?

Here's a link to check out those attack IP origins:
http://tools.whois.net/whoisbyip/