USG Flex 700 - ARP packet capture

USG_User
USG_User Posts: 374  Master Member
5 Answers First Comment Friend Collector Sixth Anniversary
in Security

We received a query from our ISP that it is receiving a huge number of ARP requests from our USG.

To check this, we've activated the packet capture on WAN1 port, but received only a few ARP requests originated from different ISP IP addresses.

My question is, does the USG captured also its own outgoing packets or only incoming packets on WAN interface? If it captures only incoming traffic, we have to put an own notebook between USG port and ISP port in order to capture the entire ARP request and respond traffic.

Accepted Solution

  • PeterUK
    PeterUK Posts: 3,391  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited September 19 Answer ✓

    The capture packet sees all ARP from the USG

    Its possible someone else on the ISP network is sending spoofing ARP for your/of your IP

All Replies

  • PeterUK
    PeterUK Posts: 3,391  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited September 19 Answer ✓

    The capture packet sees all ARP from the USG

    Its possible someone else on the ISP network is sending spoofing ARP for your/of your IP

  • USG_User
    USG_User Posts: 374  Master Member
    5 Answers First Comment Friend Collector Sixth Anniversary

    Thanks Peter,

    In the meantime our ISP has not longer follow that issue. It seems that the problem is gone.

    However, nice to know that the USG is able to capture also its own outgoing packets. This is not clearly described in the manual (or I was too blind to find it 😎)

    Greetings from Germany

Categories

Security Highlight


Read more

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）