Then 40 packets later there was another 'who has 'PC IP' tell 'fileserver IP'' event. Wireshark said 'who has 'PC IP' tell 'fileserver IP''. Only one port had the file server's MAC and I hand over handed the cable from the switch to the file server.įurther trouble isolation: I ran Wireshark from the file server and was able to capture packets during a SEP MAC spoof event. Logged into all network switches and looked at ARP tables to see if there were multiple switch ports containing the file server hardware (MAC) address. Did IPCONFIG on file server to verify hardware address. Trouble shooting performed thus far: Used ping and ARP -a from a PC to get hardware address of file server. This would be expected since all PC's have mapped drives to the file server.Ĭoncern: I am 98% sure that this pheonenom is due to a network switching issue, but that 2% possibility that I have an 'Owned' PC on my network doing a man in the middle attack compels me to root out the source in order to be 100% sure. PC's and other servers might log this event twice a week, whereas the server logs the event about 100 times a day. Other PC's and servers on the LAN also log unsolicited ARP replys in their SEP logs but not nearly as frequently as this file server. Realization: We found by looking at SEP 'Client Management 'Security' Logs' that the files server's Symantec Endpoint Security software is detecting an unsolicited ARP reply from various IP's on the LAN and automatically blocking traffic for 10 minutes.įurther information: Just about every active IP address on the LAN has become subject to blocking due to SEP receiving what it says to be an unsolicited ARP reply.

When Help Desk personnel arive, the share works. Problem: For several months, reported not being able to access file server shares.

Symantec endpoint protection mac