Stop ARP Poisoning: Fix Slow/No Internet

TL;DR

Someone is likely sending fake network messages to your computer (ARP poisoning) which is slowing down or blocking your internet access. This guide shows you how to identify and stop it.

What’s happening?

ARP (Address Resolution Protocol) translates IP addresses (like 192.168.1.10) into MAC addresses (unique hardware IDs). ARP poisoning is when someone sends false ARP messages, telling your computer the wrong MAC address belongs to a specific IP address – usually your router’s. This redirects your internet traffic through their machine, slowing things down or cutting off access completely.

How to Fix It

1. Identify the Rogue Device: We need to see which device is claiming to be your router.
   • Open a Command Prompt (type ‘cmd’ in Windows search).
   • Use arp -a. This shows you a list of IP addresses and their corresponding MAC addresses as your computer currently understands them.
   • Look for multiple entries with the same IP address, especially your router’s IP. The one that *doesn’t* match your router’s known MAC address is likely the attacker.

     arp -a

2. Static ARP Entry (Temporary Fix): This forces your computer to remember the correct MAC address for your router, bypassing the fake information. This will be lost if you restart your computer or network connection.
   • Find your router’s MAC address. It’s usually printed on a sticker on the router itself.
   • In the Command Prompt (as administrator), use this command, replacing the IP and MAC addresses with *your* values:

     arp -s 192.168.1.1 AA:BB:CC:DD:EE:FF

     (Replace ‘192.168.1.1’ with your router’s IP and ‘AA:BB:CC:DD:EE:FF’ with its MAC address.)

   • Test your internet connection.
3. Check Your Router Security: The best long-term solution is to improve your router’s security.
   • Update Firmware: Outdated firmware has vulnerabilities. Check your router manufacturer’s website for updates and install them.
   • Change Default Password: Use a strong, unique password for your router admin panel.
   • Enable MAC Address Filtering (Optional): This allows only devices with pre-approved MAC addresses to connect. Be careful – you’ll need to add all your legitimate devices!
   • Disable WPS: Wi-Fi Protected Setup is often vulnerable.
4. Run a cyber security Scan: Use reputable anti-malware software to scan for any malicious programs on your computer that might be causing the ARP poisoning.
   • Windows Defender (built-in) is a good starting point.
   • Malwarebytes is another popular option.
5. Network Monitoring Tools: For advanced users, tools like Wireshark can capture network traffic and help identify ARP poisoning attacks in real time.
   • Download and install Wireshark from Wireshark’s website
   • Start capturing traffic on your network interface.
   • Filter for ARP packets to see if any suspicious activity is occurring.

Important Note: If you suspect a serious cyber security breach, consider contacting a professional IT support service.