New ER605 Gateway adopted by SDC and within first 24hrs has generated over 24K device logs RE: ARP

New ER605 Gateway adopted by SDC and within first 24hrs has generated over 24K device logs RE: ARP

New ER605 Gateway adopted by SDC and within first 24hrs has generated over 24K device logs RE: ARP
New ER605 Gateway adopted by SDC and within first 24hrs has generated over 24K device logs RE: ARP
2025-05-04 08:28:37 - last edited 2025-07-09 04:42:57
Model: ER605 (TL-R605)   EAP245   ES205GP  
Hardware Version: V2
Firmware Version: 2.2.5

The client logs accessed within the SDC for my Site are filled with over 24,000 log entries (generated within the past 24 hours) and all appear to be relevant to just 5 or 6 devices out of the approx 45 connected / managed client devices all with IP-Mac Bindings and DHCP Client Reservations at the Site.

 

I have verified that the IP-Mac Binding data matches the DHCP Client Reservation data for every client device present at the site. I have also verified that the MAC address data within the system matches the actual MAC addresses of their respective devices. There does not appear to be a reason for the perpetually repeating warning logs.

 

The ER605 which I installed and configured the previous evening was a much needed replacement a Netgear Wireless Access Point / Router. The now defunct Netgear device had been providing DHCP and Firewall services for the local network, such as it was. At first, I suspected the cause of these log entries could have been related to aging yet still active DHCP leases from the replaced Netgear device which had not yet expired, but which contained different IP information for the given MAC addresses, specifically for those devices referenced within the logs. However, I'm now no longer as certain of that initial assumption as the rate of log generation has not diminished and the new ER605 has been in operation for over 24 hours. Since the lease durations of the previously installed Netgear router's DHCP clients were set with 2 day expiration times, and I believe DHCP clients attempt to renew their leases at 50% of their leases duration and failing that again at 7/8ths of duration then every hour thereafter until renewal or APIPA ... those aging leases should have been reissued by the ER605 by now, since the devices would have at least attempted to contact an authoritative DHCP server for renewal by now. However the rapidly filling logs entries don't appear to reflect that.

 

I suppose I will know more by this time tomorrow ... since the previously issued DHCP leases would have all expired by then...

 

Here is an example of some of the repeating log entries:

 

  EDIT: Detailed logging data has been removed from this post as it contained confidential sensitive information and the specific details of the output remain ancillary and

            irrelevant to the stated problem as well as for the eventual solution.

 

Any assistance or insight that anyone could share or provide would be greatly appreciated. I don't know if this is the result of some external influence, a problem with the switch, eap, or router and or a combination of one or more of the same, or if DHCP is glitching etc ... but I'm trying to troubleshoot and discover root cause so that I can effect a working solution and stop these runaway logs from further slowing down my gateway and sdc to a debilitating crawl.

 

Thanks in advance.

It doesn't really matter whether you think that you can or whether you think that you can't .... either way .... you're always going to be correct.
  0      
  0      
#1
Options
1 Accepted Solution
Re:New ER605 Gateway adopted by SDC and within first 24hrs has generated over 24K device logs RE: ARP-Solution
2025-05-07 05:58:19 - last edited 2025-05-07 06:48:51

  @Net-Moose 

 

Thank you for taking the time to respond. I was unaware that there were firmware issues ... my controller shows that all firmware is current. I will investigate that specific issue and remediate as I am able.

 

With regard to the duplicate IP issue ... I have resolved the repeated logging and finally cleared out the thousands of logs to that effect; but, the issue wasn't with a duplicate IP configured anywhere on my network, but rather a MAC spoofing hacker in close proximity who was apparently attempting to use any one of five separate MAC addresses belonging to devices on my network but they did not have the correct IP address for the stolen MACs ... 

 

TLDNR

 

Long story short ... the problem has been resolved, and the hacker's efforts rendered fruitless. Now the logs are no longer filling with duplicate IP address issues etc ... instead all the logs are showing are regarding large numbers of dropped packets due to SYN flood attacks ... presumably from the same bitter hacker. But, irrelevant and not an issue. The firewall is doing it's job and that makes everyone on this side of that fence very happy.

 

I do however need some assistance with a few configuration issues I'm currently facing but I will open new tickets for those.

 

Thanks again.  

It doesn't really matter whether you think that you can or whether you think that you can't .... either way .... you're always going to be correct.
Recommended Solution
  1  
  1  
#3
Options
2 Reply
Re:New ER605 Gateway adopted by SDC and within first 24hrs has generated over 24K device logs RE: ARP
2025-05-06 02:50:52

Hi @Net-Moose 

Thanks for posting in our business forum.

1. The log indicates there is an IP conflict that requires your attention.

2. The firmware is not up-to-date. 2.2.6(Official) or 2.3.0(Pre-Release). Recommend you try the 2.2.6.

But you gotta fix the duplicate IP. Or this ARP detection will flood your log anyway.

  1  
  1  
#2
Options
Re:New ER605 Gateway adopted by SDC and within first 24hrs has generated over 24K device logs RE: ARP-Solution
2025-05-07 05:58:19 - last edited 2025-05-07 06:48:51

  @Net-Moose 

 

Thank you for taking the time to respond. I was unaware that there were firmware issues ... my controller shows that all firmware is current. I will investigate that specific issue and remediate as I am able.

 

With regard to the duplicate IP issue ... I have resolved the repeated logging and finally cleared out the thousands of logs to that effect; but, the issue wasn't with a duplicate IP configured anywhere on my network, but rather a MAC spoofing hacker in close proximity who was apparently attempting to use any one of five separate MAC addresses belonging to devices on my network but they did not have the correct IP address for the stolen MACs ... 

 

TLDNR

 

Long story short ... the problem has been resolved, and the hacker's efforts rendered fruitless. Now the logs are no longer filling with duplicate IP address issues etc ... instead all the logs are showing are regarding large numbers of dropped packets due to SYN flood attacks ... presumably from the same bitter hacker. But, irrelevant and not an issue. The firewall is doing it's job and that makes everyone on this side of that fence very happy.

 

I do however need some assistance with a few configuration issues I'm currently facing but I will open new tickets for those.

 

Thanks again.  

It doesn't really matter whether you think that you can or whether you think that you can't .... either way .... you're always going to be correct.
Recommended Solution
  1  
  1  
#3
Options