Bug 218700 - the arp table may contain a fake IP address
Summary: the arp table may contain a fake IP address
Status: NEW
Alias: None
Product: Networking
Classification: Unclassified
Component: IPV4 (show other bugs)
Hardware: All Linux
: P3 normal
Assignee: Stephen Hemminger
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-10 07:08 UTC by Sergey
Modified: 2024-04-10 09:31 UTC (History)
0 users

See Also:
Kernel Version: 5.10
Subsystem:
Regression: No
Bisected commit-id:


Attachments

Description Sergey 2024-04-10 07:08:57 UTC
An entry from an incorrect interface may get into the arp table:

# arp -n|grep 100.64.1.113
100.64.1.113   ether   50:ff:20:26:fa:14  C ether9.3109
100.64.1.113           (incomplete)         ether1.2115

# ip -4 a s dev ether9.3109
1829: ether9.3109@ether9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 100.64.3.62/30 brd 100.64.3.63 scope global ether9.3109
       valid_lft forever preferred_lft forever

# ip -4 a s dev ether1.2115
1822: ether1.2115@ether1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 100.64.1.114/30 brd 100.64.1.115 scope global ether1.2115
       valid_lft forever preferred_lft forever

ether9.3109 and ether1.2115 are 802.1q VLAN, I don't know if it's important.

The ether9.3109 interface receives traffic from forgotten hardware (tcpdump -e -ni ether9 host 100.64.1.113):

10:57:08.861954 50:ff:20:26:fa:14 > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 3109, p 0, ethertype ARP, Request who-has 100.64.1.114 tell 100.64.1.113, length 46

kernel reply is
1) exists, although the ether9.3109 interface does not contain 100.64.1.114
2) contain the MAC of ether9.3109:

10:57:08.861972 3c:ec:ef:4d:94:ee > 50:ff:20:26:fa:14, ethertype 802.1Q (0x8100), length 46: vlan 3109, p 0, ethertype ARP, Reply 100.64.1.114 is-at 3c:ec:ef:4d:94:ee, length 28

# ip a| grep 100.64.1.114
    inet 100.64.1.114/30 brd 100.64.1.115 scope global ether1.2115
Comment 1 Sergey 2024-04-10 07:10:05 UTC
Kernel version 5.10.145
Comment 2 Sergey 2024-04-10 09:31:50 UTC
# sysctl -a | grep proxy_arp | grep "ether9.3109\|ether1.2115\|all"
net.ipv4.conf.all.proxy_arp = 0
net.ipv4.conf.all.proxy_arp_pvlan = 0
net.ipv4.conf.ether1/2115.proxy_arp = 0
net.ipv4.conf.ether1/2115.proxy_arp_pvlan = 0
net.ipv4.conf.ether9/3109.proxy_arp = 0
net.ipv4.conf.ether9/3109.proxy_arp_pvlan = 0

Note You need to log in before you can comment on or make changes to this bug.