ARP Cache Poisoning attacks & possible wifi issue reasons.

[Talon]

So something I noticed with both the original 1.0 Deck, and now with the OLED;

When docked, if you have the wired connection plugged in, and wifi is still on; SD is then joined via both wired and wireless, even though it does show that its primarily using the wired connection. Wifi does seem to take a backseat, but its still "on" unless you mess with it yourself, and while its in a passive state, it still seems to send out the occasional signal probably telling the network "hey Im actually thru here!" on the wired connection.

Only reason I know of this is my Av/security software suite likes to tell me when it thinks there are ARP Cache Poisoning attacks on my network, and they are always coming from the Deck (they have also in the past come from repeaters iv used, hence why I stopped running repeaters and just a 2nd actual access point). While on most home networks I know this is benign, but its still happens when it shouldnt, the OS software of the SD should be able to compensate and not blast the network.

I also think this partially explains the reasons why people report so many oddball issues with their networks when using SD + Dock, as I suspect with crappier/weaker routers and/or firewalls, they may get caught up and confused with too many ARP signals on the network which may cause network routing hiccups.

The software suite is ESET's Internet Security - Used for years and have had no major issues. This is on many machines and devices on the network and is in addition to hardware router/firewall/pihole filtering.
Router is Unifi USG - and 2 Unifi APs (of diff models but nothing currently newer than wifi 5).

I also think the reason people have very intermittent wifi issues (with old and new deck, but specifically with newer wifi 6 potential devices) is due again to bad/old/poorly-designed wifi routers that either dont properly broadcast their abilities to the deck, trying to force negotiation on bands and frequencies they dont have, considering 5ghz signal width has been anywhere between 20 and 160, with only the newer wifi 5 and wifi 6 devices supporting 160.
I have a mix of the 2 personally. I know for a fact Iv had to change some settings to prevent devices capable of 160 trying to auto negotiate to the AP that doesnt support it, thinking it should be able to causing tons of wifi connectivity issues. I have a feeling there are people who have older 5ghz routers, that dont support 160 width, and the devices dont properly tell the SD "Hey I cant do this.. drop to 80", or perhaps dont even relay what they support at all, and the SD just tries to guess.
Whether its the SD's fault, or the fault of the router is hard to say. I do think wifi drivers of devices should be smart enough to downshift, but evidence shows they dont. Is it the fault of the router's with possibly bad software/firmware design not conforming to standards? Or is it the numerous wifi adapters in phones/laptop/handhelds/etc?

Just sharing my experiences.

[TCH]

have exactly the same issue, ESET antivirus is reporting ARP poisoning attacks from SteamDeck IP

[Talon]

Yep, it seems mostly benign, still kind of annoying though. I dont think most other software suites even track arp cache stuff which is maybe why this is not noticed more. Again, like i said above, my only guess is due to how the networking works, and technically 2 ips, 2 mac addresses, going to the same host/host name freaks stuff out.

[YOLOSWAG4JESUS]

This is useful to know. Don't know if I have the technical expertise to do anything about it, but I'll keep it in mind if I ever get a dock and start noticing weird network issues.

[ReBoot]

Yup, an issue with network equipment/ESET. The Deck behaves perfectly within specifications.