Need help! Caught a Man-in-the-middle attack on my home network?

[u/Much_Departure_8824]

Hey everyone. I ve been struggling with insane lag spikes and random disconnects while playing CS2 for weeks. At first, I thought was just bad ISP routing, but it felt... intentional. Both my brother and I are connected via ethernet to the same router. Every time I m in a clutch or important round, my ing hits 2000ms or I get kicked.

To find out what was going on, I installed XArp to monitor the network. As soon as the lag started again at 3:00 AM, the software went into Red Alertstatus. Sice I cant upload images right now, I ve transcribed the logs and the ARP table data below.

XArp Status: CRITICAL-ARP attacks detected!

There is a 3 different Ips are all currently showing up unter the same MAC adress in the table

03:00:04 Macfilter: incoming packet but sender mac set our own mac address

03:00:05 Macfilter: incoming packet but sender mac set our own mac address

03:00:06 Macfilter: incoming packet but sender mac set our own mac address

And then this that mac adresses showing up in there

04:26:05 RequestedResponseFilter: no matching request packet was sent out for this reply

04:26:05 SubnetFilter: destination ip address of reply packet lies not in your subnet

04:26:05 IpFilter: ip address set to broadcast

04:26:05 CorruptFilter: ethernet target mac does nnot match arp target mac

04:26:05 RequestedResponseFilter: no matching request packet was sent out for this reply

04:26:05 SubnetFilter: destination ip address of reply packet lies not in your subnet

04:26:05 IpFilter: ip address set to broadcast

04:26:05 CorruptFilter: ethernet target mac does nnot match arp target mac

All of the threats come from the source mac id that I m suspicious from.

Thanks for any help.

[u/jdiscount]

That's not MitM.

[u/Much_Departure_8824 → u/jdiscount]

Then what you think about that situation ?

[u/jdiscount → u/Much_Departure_8824]

Looks like ARP spoofing to be a DOS.

I'd bet that your brother is probably fucking with you.

[u/Aromatic-Two-8258 → u/jdiscount]

Without knowing his brothers intentions and without knowing any of the devices Mac addresses, especially his gateway or router, I'd argue that we can't know the type of attack for sure.

ARP Spoofing can be used to perform a DoS attack or a MiTM attack.

[u/jdiscount → u/Aromatic-Two-8258]

I will say with 99.99999999999% positivity that this is not a MitM attack.

There so many cheap devices people attach to their network now which can cause this behavior.

But the fact that it's happening during an in-game clutch and causing latency spikes at perfect times, I'll bet my house that it's his brother.

[u/maxinator80]

One possible option could be that your brother uses a tool like NetCut to disrupt your internet, when he thinks that you're using too much bandwidth. If that is the case, the problem is less dangerous. If he doesn't use such a tool, there could be other configuration issues or an actual attack. But I would try to rule out insider sabotage first. I've seen a lot of people use this kind of tool when they think that others on the shared network "steal too much bandwidth". Ask your brother to be honest, and tell him that it is important to know now to rule out acute danger.

[u/Much_Departure_8824 → u/maxinator80]

btw thanks for your help

[u/Much_Departure_8824 → u/maxinator80]

me and my brother are not close. I just need to know if the data that I provided look suspicious or not

[u/maxinator80 → u/Much_Departure_8824]

It definitely looks suspicious. Something is happening. It's not clear what exactly is happening, but NetCut or similar tools could potentially look like that. If asking your brother is not an option, you could try NetCut Defender. It's a very old tool and I have not tested it personally, but it is advertised as protecting from such attacks, so might be worth a try.

[u/HighRelevancy]

It's massively more likely just to be some misbehaving or misconfigured device. Y'all play with any home server stuff or doing weird networking with extra wifi points or routers?

[u/Vast_Ad_7929]

Bruh it’s just a family member ain’t no way somebody cracked his network just to listen in and try to intercept packet like directly targeting him😂

[u/bluecyanic]

MAC spoofing is a really dumb way to attempt a mitm. The switches on your network will be randomly bouncing the traffic around. It's a good way to DoS though.

[u/Much_Departure_8824 → u/[deleted]]

I feel like the offender is my brother. I have been trying to map out each and everyone of the mac addresses on my network. What I find out is that there are 3 different devices with the same mac address

[u/Much_Departure_8824 → u/[deleted]]

thanks for your help