Misbehaving Router

Tried to get answers to this question elsewhere on this Forum.
Question why does my Ultrahub Router (Vodafone) answer all the ARP Broadcasts on my LAN for IP Mac resolution. I’ve found if you do a manufacturers’ reset the problem goes away.
Ask CHATGpt got following answer.


If your broadband router is answering every ARP broadcast with its own MAC address, it’s typically due to one of the following reasons:

1. Proxy ARP
Your router might have Proxy ARP enabled. This is a feature where the router responds to ARP requests on behalf of another device—effectively saying, “send the traffic to me, I’ll forward it.” This is usually used in complex network setups, like:
Bridging two networks without requiring routing configuration on hosts.
Supporting legacy setups or poorly segmented subnets.
Why this matters: If a host sends an ARP request for an IP not on its subnet, the router responds with its MAC to intercept and route the traffic.
2. Misconfigured or Overly Aggressive ARP Handling
Some routers respond to all ARP requests, even for IPs not in their subnet, either due to:
Misconfiguration
Custom firmware (e.g., DD-WRT, OpenWRT)
Manufacturer-specific behavior for DHCP relay, captive portals, or traffic monitoring
3. ARP Spoofing or Poisoning
If your router has been compromised, or if malware is present, it might intentionally answer ARP broadcasts to hijack traffic. This is uncommon but worth checking if the behavior is suspicious or recent.
4. Transparent Proxy / NAT Tricks
Some ISPs or routers use transparent proxies or advanced NAT tricks where the router pretends to be every device. This is common in carrier-grade NAT or when intercepting traffic for security/content filtering.
How to Check
Run a packet capture (e.g., Wireshark) and look at the ARP responses.
See which IPs the router is responding for. Are they inside your network? Are they active devices?
Log into the router and check for Proxy ARP, ARP table entries, or unusual features.
How to Fix
Disable Proxy ARP if it’s not needed.
Update firmware or reset the router to default settings.
Segment the network properly to avoid weird ARP behaviors.
Check for security breaches.

The answer does make perfect sense since Ultrahub I believe is OpenWRT, this points to either some one snooping, virus or connection method is being changed.

I ran wireshark previously and sure enough the router was answering all the ARP requests

Any ideas

Other possible reasons,

- if your router is also providing a VPN service for remote clients, and if you have allocated a pool of IPs reserved from within the same subnet as the LAN, it will generally provide ProxyARP on behalf of remote clients to create the illusion of L2 adjacency. This is not necessary if the VPN pool is a separate subnet and the router is already the default gateway for LAN clients as that is handled as per normal routing.

- some Wi-Fi APs can optionally respond to ARP traffic on behalf of connected but sleeping clients, but for that function it should be spoofing the client's MAC rather than using its own MAC (aka "yep that's my IP too").

Edited by prlzx (Wed 14-May-25 13:30:29)

There is no VPN used that, there are fixed and DHCP ip hosts, there are two DHCP servers, the addresses do not overlap, both given the same default gateway.
When issue arises, the Ultra Hub answers every ARP broadcast query with its own MAC address both for fixed and DHCP hosts.
Running AngryIp illustrates the problem listing most of the 253 ip addresses having the same MAC address, a few will have the correct address, run it again you will get different hosts with correct addresses.
.Checked with Wireshark this shows exactly what is happening UltraHub is answering every question.
It’s almost as if UltraHub is treating LAN addresses as if they are public.

Date is June 17 the Ultra Hub still working correctly, at present looks as if It’s been fixed. ?