ARP poisoning? ISP?

[Deepshark]

Hello guys,

I was running some wireshark over my ethernet and I kept finding an ARP broadcast coming from an unknown mac address which is not connected to my router and is asking for IP addresses inside the gateway my router is connected to through PPPoE.
My gateway is 10.0.0.1

I am getting those ARP Broadcasts as well as a DCHP offer made from an IP starting with 100 that doesn't belong to my network.
I traced it and goes back to the ip pool of 10.0.0.1 if I didn't understand it wrong.

I am a bit paranoid. I think this is the ISP sending requests to my router because I replaced the ISP router with my own, and maybe they have setup some VLAN system or something.
But.... I would like to make sure, and if possible block this entirely.

Could you help me?

 

[ColinTaylor]

It looks like normal broadcast traffic on your ISP's local network to which your router is connected to.

Are you running Wireshark on a PC connected to your LAN? You might be able to stop those packets by setting WAN - Internet Connection > Special Requirement from ISP > Enable VPN + DHCP Connection to No.

P.S. You don't need to redact any of the information you did. None of it is sensitive. The only information that would need to be redacted is your router's public IP address.

P.P.S. Do you have a public IP address? It looks like your ISP might be giving out CG-NAT addresses (100.67.x.y) instead.

 

[Deepshark]

Yes, Wireshark is running on a PC connected to my LAN.
I will check how I can do this, I was trying to block this on my Asus Merlin but was unable to.

Thanks for the PS, just wanted to be careful as I am not an specialist in networking... I know the basics but this whole thing escapes my knowledge

I am not sure about having a public IP Address. It is, perhaps, a possibility.
The ISP in this country works quite different to other I have been into. There's no fiber at my home, my router is connecting through an ethernet entering my home which makes me believe there might be a common building-based ONT serving every other router.

 

[sfx2000]

P.P.S. Do you have a public IP address? It looks like your ISP might be giving out CG-NAT addresses (100.67.x.y) instead.

That's a good catch - and the 10dots might be additional WAN traffic...

The 10.99.73.1 could be upstream - depends on how the WAN router is configured...

Anyways, not really enough info here to make a determination, but I think this is likely harmless traffic on the ARP side - it's just discovery for IP vs MAC addresses...