I have the following Linux networking setup: there is an eth10 network interface with the assigned address 10.11.0.1/24. Then there is a tap0 network interface with assigned dummy address 0.0.0.1/32 (I assigned a dummy address to bring the interface up), and traffic from/to that is controlled by a userspace program that originally created the tap0 interface. On the other side of the tap0 interface, there is a userspace program using it via raw sockets that looks for ARP requests and constructs a response.
Now, when the userspace program constructs an ARP request asking for 10.11.0.1, I expect the the other raw socket userspace program to reply to it. However, I get two replies: one from the raw socket program and another coming from Linux kernel.
Apparently, the Linux kernel deduces that 10.11.0.1 is an address belonging to it and thus replies. However, 10.11.0.1 is not an address of the tap0 interface. It is an address of the eth10 interface.
My question is: why does the Linux kernel do that? Is there any way to disable ARP replies on the wrong interface?
My interim solution to this problem is to use other address than 10.11.0.1 for the raw socket / tap0 purposes. But, because this system is supposed to be a system-level test for an application that can be run on any development machine, I cannot guarantee that there are no IP address clashes with other interfaces. Thus, it would be nice to disable ARP replies on the wrong interface.
Another solution to this problem is to use netmap that reserves the entire interface for the userspace application, preventing the kernel from using it for anything while the userspace application is running. But I would like my tests to run without netmap.
Best Answer
Why do you call the ARP reply "wrong"? The system's IP address can certainly be reached via that interface. This is why the ARP reply is sent to begin with. Not doing so might cause some traffic to flow via less optimal paths, or not at all. For example, tap0 might be a VPN connection, and this ARP reply helps to ensure that traffic to the other IP address will flow correctly through the VPN.
If you really want to do this, you can set the sysctls
arp_ignore
andarp_announce
to desired values.And
arp_ignore
is described as:So, you would want to set
arp_ignore
to 1 (or possibly 2) andarp_announce
to 2.For testing, it is probably fine to do this. But a real production system will likely behave in the manner you experienced, and your program needs to be able to deal with that.