Home / server / Questions / 314522
Accepted
bk.
Asked: 2011-09-23 11:08:11 +0800 CST

Multi-NIC Linux machine's NICs are responding to each other's ARPs regardless of arp_filter setting

  • 772

I have an old Linux machine running a 2.4.37 kernel. In the machine are two NIC cards both on the same network with different IPs. For some testing, we want each IP's traffic routed through that NIC, but what is actually happening is all the traffic for both IPs is getting routed through one of the ethernet devices and the other is unused. If I take another machine on the network with an empty ARP Cache and ping both IPs, and then check the ARP Cache, I see that it has the MAC for one of the two NICs under both IPs. Basically the Linux box is allowing both NICs to respond to ARP requests for each other- which is the default behaviour. However, I have arp_filter enabled for both NICs which is supposed to eliminate this from happening, but appears to have no effect. I've also tried disabling rp_filter, but that seems to have no effect either. Here are my relevant sysctl entries:

net.ipv4.conf.eth1.arp_filter = 1
net.ipv4.conf.eth1.rp_filter = 0
net.ipv4.conf.eth0.arp_filter = 1
net.ipv4.conf.eth0.rp_filter = 0
net.ipv4.conf.lo.arp_filter = 1
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.default.arp_filter = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.all.rp_filter = 0

I find tons of links to people with the same problem on google, but once they set arp_filter=1 the problem goes away for them, but not for me.

Edit: I've also been playing with various arp_ignore and arp_announce settings, but no matter what I do I can't get each interface to only respond to ARPs for its own IP

linux arp ethernet

1 Answers

  1. Best Answer

    From the Guide to IP Layer Network Administration with Linux:

    One method for preventing ARP flux involves the use of net/ipv4/conf/$DEV/arp_filter. In short, the use of arp_filter causes the recipient (in the case below, real-server) to perform a route lookup to determine the interface through which to send the reply, instead of the default behaviour (shown above), replying from all Ethernet interfaces which receive the request.

    The arp_filter solution can have unintended effects if the only route to the destination is through one of the network cards.

    So arp_filter works by consulting the routing tables to determine which interface should be used to send packets to the requesting host. If your routing table has a single default route like this:

    default dev eth0 src 192.168.0.10

    then it will always send ARP replies on eth0, regardless of whether eth0 has the matching IP or not.

    One possible solution (I haven't tested this) is to setup source policy routing which selects the outgoing interface based on the source IP:

    echo 10 eth0 >> /etc/iproute2/rt_tables
echo 11 eth1 >> /etc/iproute2/rt_tables
ip route add 192.168.0.0/24 dev eth0 table eth0
ip route add 192.168.0.0/24 dev eth1 table eth1
ip rule add from 192.168.0.10 lookup eth0
ip rule add from 192.168.0.11 lookup eth1
    • 1