- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
How to stop the NetCut software through SonicWall
04/28/2020 
1 People found this article helpful
90,298 Views
Description
Administrators face a challenge with few technical users in their organization who can try to stop the Internet usage for other users by using a software which can proxy the mac address of other user's system. The main purpose is to increase the bandwidth usage per ip by stopping the Internet traffic for few users.
One such software is Netcut from Arcai vendor who has released app for iOS and Android as well now.
Cause
- These softwares or applications can proxy the mac address list of any system in the local networks thereby manipulating with router's or firewall's ARP table.
- Notice the ARP table of the SonicWall before and after running the software :
- Running packet capture on the firewall will show that firewall will send the traffic response to that dummy mac address, instead of original mac address after using that software :
Resolution
To prevent this, SonicWall has an option of MacAntiSpoof which can be configured as following to block the software :
- Navigate to Manage |System Setup | Nnetwork | Mac-IP Anti-Spoof.
- Select the local interface from where the user is using the software.
- Under Anti-spoof settings, select the option Enable MAC-IP based anti-spoofing and 'DHCP SERVER - Populate MAC-IP anti-spoof entry from DHCP Lease.
- Under ARP settings, select the option ARP Lock - Lock MAC-IP binding in ARP cache to prevent ARP poisoning from others.
Related Articles
- Analyzing TCP reset(RST)packets
- ‘Error sending one-time password’ encountered when connecting to NetExtender
- Supported SonicWall and 3rd party SFP and SFP+ modules that can be used with SonicWall NSsp series
Categories
- Firewalls > SonicWall NSA Series > Networking
- Firewalls > SonicWall SuperMassive 9000 Series > Networking
- Firewalls > TZ Series > Networking
- Firewalls > NSv Series > Networking
- Firewalls > NSa Series > Networking
YES
NO