1

Assume a physical switch with the following physical or virtual nodes connected to it (we are talking about a lab environment):

  • "client" at 192.168.1.1, it sends requests to 192.168.1.2
  • "server1" at 192.168.1.2
  • "server2" at 192.168.1.2 (this IP is not an error)
  • "controller" at 192.168.1.100

The target is configure all system in a way that "controller" can decide if the client must work with server1 or with server2. That is, a command in the controller must modify network in order that "client" sees at address 192.168.1.2 the server1 or the server2.

I'm thinking on following possibilities:

  • using VLANs: VLAN 10 (by example) will contain the client and the server that must receive its request. The controller should modify which of the server1 or server2 belongs to the VLAN 10.
  • using a virtual switch created in the controller: this virtual switch will have as connections the client and the server related to it. The controller must connect/disconnect to the virtual switch server1 or server2.
  • tricking ARP: disable ARP answer in both server1 and server2. The controller will answer to ARP queries for 192.168.1.2, giving as answer the address of the server1 or server2.
  • ... (other options).

Any hint about the most common/feasible option? existing related software? (all machines are Linux ones).

Clarification:

The final objective is, in a lab, allow automatic testing. A test session could be, by example:

  1. clone server2 from a master image.
  2. apply patch under test to server2
  3. route traffic to server2
  4. execute automated test

in parallel, other clones of client and/or server could be in use by other test sessions.

15
  • 1
    Since all devices are on the same network, I think spoofing ARP is the best way. – Ron Trunk Feb 9 '18 at 13:25
  • What you describe is a load balancer, any reason to reinvent the wheel rather than use an existing system? – JFL Feb 9 '18 at 13:27
  • @JFL: a load balancer (let say an F5) when both final servers has same IP involves more than one (V)LAN, etc. I do not say your comment is not valid, but it should be more elaborated (by example, in a full answer). – pasaba por aqui Feb 9 '18 at 13:33
  • @RonTrunk: thanks for your help on this issue, any software suggestion? something that allows in a easy way decide and generate the ARP answer when the ARP "who is" is received from IP=xxx and MAC=yyy. – pasaba por aqui Feb 9 '18 at 13:36
  • 1
    I can foresee a lot of issue trying to do this. ARP spoofing will only work with one connecion at a time, you will not be able to have client 1 <--> server 1 and client 2 <--> server2 at the same time. IP was designed with IP address uniqueness as a principle. There's well known techniques to balance flow on a server farm. Reinventing them from scratch will take some time. – JFL Feb 9 '18 at 13:42
2

If you want to do this on layer 2 entirely, you need to remove regular ARP from the servers. You can either filter ARP on the OS level (e.g. Linux with arptables) or on the switch level using ACLs. Then, you generate gratuitous ARP somewhere to make the clients use the destination MAC that's currently desired.

Doing this on layer 3 requires a router in between. There are two basic variants.

  1. The servers must be on another subnet. You configure the router for static ARP and change that as required. If the client isn't supposed to know it's using a router you can set up proxy ARP for make believe.
  2. Using destination NAT on the router, you map 192.168.1.2 to the one or the other server's IP (which are actually on another subnet/VLAN). This method can also be combined with policy routing (or mapping some ports to Server1 and others to Server2) and it's similar to load balancing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.