guardianproject / guardianproject/orbot-android
[BUG] ARP attack in the new versions.
- Dominant language
- Kotlin
- Stars
- 3.5k
- Forks
- 485
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 24
Description
**Describe the Bug**
It will perform ARP attacks after upgrading to [17.2.1](https://github.com/guardianproject/orbot/releases/tag/17.2.1-RC-2-tor-0.4.8.7).
My PC has detected the phone keeps broadcasting its MAC with the router's IP. This makes all devices lose connection.
**To Reproduce**
Steps to reproduce the behavior:
1. Start VPN (Use direct connection to tor)
2. Wait it connected
3. Wait about 5~15 min
4. Check any device or route log, you will see the ARP attacks
**Expected Behavior**
What are you doing?
**What Custom Configuration Do You Use?**
Choose some apps not to use with Orbot, and other settings please check the screenshot below.
**Screenshots**
Settings

**Smartphone (please complete the following information):**
- Device: Perm 10
- OS: Android 11
- Version: v17.3.2 RC 1
**Crash Logs (Advanced)**
I'm sorry I can't offer this.
**Additional Context**
This problem did not occur in previous older versions.
Contributor guide
No contributing guide indexed for this repository
Research direction
No source file or test is identified. Start by reproducing the report on Android 11 with Orbot v17.3.2 RC1, using a direct Tor VPN connection and the reported custom app exclusions, then inspect device or router logs after 5–15 minutes. Done means identifying the cause of the ARP broadcasts and verifying that the VPN no longer produces them without breaking connectivity.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- mobile-dev, networking, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100