0

My machine has a physical network interface (eno1) and a bunch of virtual network interfaces (e.g. tap0). Each interface has its own IP and their subnets do not overlap.

I noticed that if I perform an ARP request from another machine that is connected to eno1's network asking for an IP that belongs to a virtual network interface (e.g. tap0), Linux will respond the ARP request, and it will respond with the MAC address of eno1 (that is, it responds with the MAC address of the interface that received the ARP request, regardless of which interface had the IP address)

Linux will only respond the ARP request if the IP belongs to one of its configured network interfaces, otherwise it ignores it.

I wonder what is the reason that it does that? I would think that it would simply ignore such ARP requests, as they are targetting IPs that are not only held by different interfaces, but also outside the subnet range.

Thanks!

@edit: As requested, this is the real example that I observed:

Machine 1 has interface eno1 with IP 192.168.0.2, subnet 192.168.0.0/24, MAC address 82:a2:17:43:15:ef

It also has interface docker0 (virtual) with IP 172.17.0.1, subnet 172.17.0.0/16, MAC Address 02:42:6f:31:bb:58

Machine 2 is connected to the same subnet of eno1 and has IP 192.168.0.55. Machine 2 performs an ARP request to the network, asking for the owner of IP 172.17.0.1.

Machine 1 answers the ARP request with MAC address 82:a2:17:43:15:ef (eno1 MAC address)

Additional notes:

  • Machine 1 will only answer the ARP request if the IP belongs to one of its network interfaces.
  • Machine 1 will always answer the MAC address of eno1, regardless if the target IP belongs to docker0, tap0, etc.
Improve this question
5
  • You should add some concrete examples of the IP addresses involved. Also, is the response correct? If the MAC address is correct for the interface then I would assume it is doing what it is supposed to do. What source IP is asking and what IP is it asking for? What is the MAC address associated to that IP address?
    – FrameHowitzer
    Commented May 2, 2023 at 3:30
  • Hi @FrameHowitzer, thanks for the answer, I updated the question with the real example. It always responds with the MAC address of eno1, which is the interface that received the ARP request, but not the interface that has that IP address. I find this behavior a bit weird, but I would imagine this is proposital
    – felipeek
    Commented May 2, 2023 at 3:40
  • Ah yes, ok so it is responding with correct addresses. As noted below that is default for Linux. It is a bit dumb in that way. It assumes that doing something, even if a bit wrong, is better than doing nothing. It should really do nothing in those cases but the traffic reaching it on the wrong network is also an indication that something else is wrong with the setup, probably.
    – FrameHowitzer
    Commented May 2, 2023 at 14:22
  • @FrameHowitzer I wouldn't say "correct", but appropriate. As I answered, it's proxy_arp behavior, and likely not what anyone actually wants. But it's also something that should never happen. (I was around when they started this crap, but don't remember to exact logic behind it.)
    – Ricky
    Commented May 2, 2023 at 18:38
  • Yes, I have been bitten by it before as well, years ago, and suspected this might be the same kind of thing but didn't want to, well, assume too much without asking for more details on the actual behavior. It's a frustrating design and never really made much sense to me why they did it. It's a deceptive failure that makes it seem things are working even though it would be better to fail more visibly.
    – FrameHowitzer
    Commented May 3, 2023 at 14:04

1 Answer 1

Reset to default
3

0 - (default) The kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but it usually makes sense, because it increases the chance of successful communication. IP addresses are owned by the complete host on Linux, not by particular interfaces. Only for more complex setups like load- balancing, does this behaviour cause problems.

https://sysctl-explorer.net/net/ipv4/arp_filter/

It's a bit of a bad default, but linux is a host first, and router somewhere down the list. While it's intended to "just make things work", it can create a mess, but your network is already a mess if arp's are arriving on the wrong interface(s).

(set it to "1" to stop this proxy_arp behaviour)

Improve this answer
1
  • Thanks! Solved!
    – felipeek
    Commented May 2, 2023 at 4:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.