ARP cache poisoning attack

It just ceased, but ESET NOD32 kept picking it up for maybe a half an hour, but it ceased. I know about false positives, and I am on a NAT 2 network, but I am still worried that it might have been an actual attack.

What exactly should I do to ensure that it was a false positive?

 

I'd always recommend running a full on-demand scan and you can also send the scan log and a SysInspector log to ESET Customer Care to make sure.

 

So, YOU don't really trust the scan-results either ?

 

If I didn't trust the scan, I wouldn't have recommended running another scan. Rather, the fact that ESET picked up a possible ARP Cache Poisoing Attack proves the scan works. Whether the detected attack was a legit attack from a malicious source or due to a task or action that triggered the detection is what is in question.

This KB Article provides more information on how to determine whether or not the detection was a real attack and also how to help avoid future false positives.

DNS Cache Poisoning Attack

The title of the article is for DNS Cache Poisoning Attacks but is also relevant to ARP Cache Poisoning Attack detection.