ARP Content Changed

I have a router and an extender installed in my network…From time to time I get the "ARP content changed message from Glasswire…IP:192.168.99.1, Old MAC:(address of the router), New MAC: (address of the extender)…I lose internet during this process, until it resolves itself…Then sometimes it reverses… IP: 192.168.99.1, Old MAC:(address of the extender), New MAC:(address of the router)…I hope I can get some assistance concerning this issue…Thanks in advance…

1 Like

@canadien37

Another customer had this same exact issue.

That customer had a modem from their ISP that was a router, then they had a secondary router. So, they had a router behind a router. This setup caused network problems and it was causing a device to share an IP address and it would cause outages and other network issues.

Could you have a router behind a router? If so perhaps your modem can be set up so it’s not a router. This setting is usually called something like “bridging mode”.

Also just to be clear, GlassWire is not responsible for the network issues and these issues should still occur even if GlassWire is no longer installed on your PC. GlassWire is just detecting two devices sharing an IP address and giving the ARP warning for that reason, but GlassWire is not taking any action here or doing something to your network. It’s merely an informational alert.

https://en.wikipedia.org/wiki/ARP_spoofing - More info about ARP spoofing.

Thanks for the reply, Ken…to be more specific I have FIOS service, there is no “modem” per se, but my router connected to the FIOS ONT…I recently installed a Netgear wireless extender in my network to provide wifi throughout my house…I am using it as an extender, not an access point…The MAC addresses involve these two devices and my desktop computer is the only device affected, all other devices maintain the internet without interruption…My desktop is connected via ethernet to the router…

I know Glasswire is not responsible for the issues, I’m just trying to troubleshoot the issue…Any other ideas?

Don

@canadien37

To be honest I’m not sure. All I can say is that it’s most likely a shared IP between two devices. If it was me I might do a clean reset of the hardware and double check the main access point is in “bridging mode” or something similar in its settings.

I guess you could also not use the extender for awhile and see for sure if that’s the issue. If the issue goes away then you know it’s probably some setting for the extender that’s causing the issue.

It’s difficult to recommend something without having access, and without having any experience with that exact hardware.

1 Like

As you’ve said, GlassWire appears to be telling you that the wireless extender has replaced the router as the Internet gateway device.

Problems with the ARP cache have happened to other users but I haven’t seen your problem before.

I’ve heard of the same or similar problems from: a faulty cable or device; hardware incompatibility between the router and the extender - a quite common problem; a misconfigured network; and deliberate ARP cache poisoning:

Initially, you could confirm that GlassWire is only reporting that the Windows ARP cache has changed by running the Windows ARP command:

Then you could confirm that the router ARP cache matches the Windows ARP cache. The router ARP cache is usually called something like the MAC Address Table.

Let us know the results of such checks. Also, let us know if you resolve the issue.

If you are concerned that GlassWire is “contributing” to the issue then you could disable it or uninstall it and wait to see if your desktop still has connection problems.

1 Like

Also, just to be clear, it should be impossible for GlassWire to contribute to this issue because it only reads some data about ARP issues. It does not have the ability to take any action since it does not interface with the router, or extender.

But sure, you can remove GlassWire in add/remove programs and confirm the issue is still happening, then reinstall it.

Thanks for the responses…I know Glasswire has nothing to do with causing the issue…Anyway, I have flushed the ARP cache and assigned the extender a static IP address…Hopefully this will resolve the issue…If not, I’ll have to dig deeper…unfortunately I can’t compare the router cache with the Windows one…The type of router I have is Android based and does not have a built-in web page…Any settings adjustments are made via an Android app…or on the router’s graphical display…the settings adjustments are basic, no provision to view ARP cache…I will post again either way, if issue is resolved or not…Thanks again for the help…

2 Likes

Sorry it took so long to update this topic…the issue is resolved…I flushed the ARP cache and assigned a static IP to the extender…No more issues…Thanks for the help…

2 Likes

I’m glad it’s working now! For anyone who is curious how to clear the ARP cache with Windows I have added the command prompt commands below. You may have to open the command prompt as admin.

netsh interface ip delete arpcache

1 Like

i have the same exact problem. how did you solve it?

@MadMuss

I believe their modem needed to be in “bridge” mode or something like that, then it was no longer a router behind a router.

1 Like

i have both my routers set to “route mode”, are you sure that it should be bridge mode? because i dont wanna mess it up
if not sure maybe you can help me with it?

@MadMuss

I’d recommend calling your ISP to confirm or checking their forum. I don’t want to cause you any problems either and I’d probably need to call your ISP myself to understand the situation in full and suggest something.

oh then never mind. its not worth it. thanks anyway