My first ARP attack

1. My background:
I have not graduated from a 2B school. I have just finished my junior year and I am a quasi-Graduate (you can say that !), After the introduction, I went on to a city with a very developed service industry. All the way to the West, I went to a computer sales and service center integrating sales and services. I had my own store in the Computer City, there are computer/printer maintenance contracted by other companies and network maintenance (pc <50) by small companies, as well as security protection. I basically have to deal with all the problems there (I don't know about security). To be honest, I don't know a lot of things, and many of them ask my colleagues to solve them.
Ii. ARP attack approaching
After two weeks, I was able to solve the problem. Then, my boss arranged for me to go to another company to handle computer, printer, sharing, mail, and other problems. The phone number was always on standby.
Suddenly the familiar ringtone on the phone rang, and the old man (we all care about boss) came over the phone: "XX Company experienced an ARP attack, you looked at it. "When I got down, I opened my laptop and checked the company's address. Then I checked my car on www.zuoche.com and registered the car information. Carry a backpack and start with your toolkit (each technician has his own Toolkit.
I switched to another car and asked passers-by A, B, and C-ding to finally find the company for me. The old man drove to this company with me, but I can't remember it, after all, self-driving is different from public transportation! It's not a matter of self-affinity.
1) The first time I played "smart"
(I learned the time, figures, and locations from the old man.) Find the person in charge of the company and find out some problems,
Problem: 1. The person in charge's computer is the company's database server, installed with 360 anti-virus software,
The software prompts ARP attacks from 192.168.1.1 mac: 08-42-AC-3E-E7-B0.
2. This also happens to the computer of an employee.
My idea: this problem occurs on two computers in the office. It should be 360 error!
My operation: log on to the company's vro (tp-link) and check the mac of the vromac and the mac of other devices. No mac address prompted by the software is found, then, you can set the static IP address on the computer where the problem occurs, and set the 360 prompt to no prompt later (clever ). Just say hello to the person in charge and then go back to the company.
2) The problem is serious.
The next morning, I went to work on time. When I first entered the company's boss, I forwarded the text message from the person in charge of the company I went to yesterday: early, XX: My computer's ARP network disconnection attack continued, I have been there for more than 100 times this morning. Please come over later. After scanning the text message, call back to boss (old man) to explain the situation of yesterday (I forgot to report the situation yesterday, but I was wrong). How can I solve the problem? I replied: I finally got rid of the situation and started again with my equipment. At the door, I met an old man. He said, "how is this college student? How can this problem be solved? If you don't ask me again (don't leave a back path for yourself), I will tell you that you used to unplug the network cable of the wireless router on the fourth floor of his office. I nodded.
3) Bus ideas
I listed the possible causes of ARP attacks.
1. virus caused by employee computers
2. External hacker attacks
3. DHCP server problems
4. There is a device with the same IP address as the router in the network.
5. Poor contact between vswitches and vro Interfaces
At this point, I should have a clear understanding of the company's network topology.
3. Find the attack source-employees access the wireless router without permission
I have been to the company for 10 o'clock. I came twice yesterday (the first time I installed the AP for the lead). The security guard knew what I was doing and said hello, I went to the office building.
I used his computer to log on to the router and checked the route table. Then I told the owner where to place the vswitches and vro devices (at this time, I want to log on to those vrouters, because the company's vrouters have wireless functions ), the person in charge worked very well and picked up the phone and asked the electrician to come to the office.
1) Register devices and draw network topologies
I ran along with the electrician. While registering the device model and device mac address, I asked the employee if he could access the Internet and draw a topology. It took about 20 minutes to go back and forth.
2) Unexpected Detection
While registering the last office, I was surprised to find that a female employee had a wireless router on the computer chassis. When the electrician said: Hello, check the network now! At that time, the working female employee was suddenly shocked (maybe she knew she could not bring her own wireless router !)
I asked why the router was disconnected. After consulting and consent, I began to log on to this wireless router. When I logged on, I almost cried (exaggerated or exaggerated). That was so excited! As soon as you see the mac address 08-42-AC-3E-E7-B0, you will be very familiar with it. Open my notebook and compare it with NND. It's exactly this vro!
3) Subsequent processing
Disconnect the wireless router, which will be processed by the company later
Iv. Summary
The first time I solved ARP attacks for the company, I had a little sense of accomplishment and made the following summary:
1) for the first time, it was inevitable to be nervous and at a loss, but to find the right method
2) I will always leave a path for myself (taught by the Old Man). I will take this opportunity to familiarize myself with the company's network topology, the ip addresses of those devices, the administrator password, and the existing services, facilitate your maintenance work.
3) A person who is smart may not be better off. Change it! Good luck!