Fw: [Bug 218700] New: the arp table may contain a fake IP address

Fw: [Bug 218700] New: the arp table may contain a fake IP address

[Stephen Hemminger]

This looks like a side effect of the Linux neighbor table
and weak host model. So don't get too worried about it.

Begin forwarded message:

Date: Wed, 10 Apr 2024 07:08:57 +0000
From: bugzilla-daemon@kernel.org
To: stephen@networkplumber.org
Subject: [Bug 218700] New: the arp table may contain a fake IP address


https://bugzilla.kernel.org/show_bug.cgi?id=218700

            Bug ID: 218700
           Summary: the arp table may contain a fake IP address
           Product: Networking
           Version: 2.5
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P3
         Component: IPV4
          Assignee: stephen@networkplumber.org
          Reporter: a_s_y@sama.ru
        Regression: No

An entry from an incorrect interface may get into the arp table:

# arp -n|grep 100.64.1.113
100.64.1.113   ether   50:ff:20:26:fa:14  C ether9.3109
100.64.1.113           (incomplete)         ether1.2115

# ip -4 a s dev ether9.3109
1829: ether9.3109@ether9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc
noqueue state UP group default qlen 1000
    inet 100.64.3.62/30 brd 100.64.3.63 scope global ether9.3109
       valid_lft forever preferred_lft forever

# ip -4 a s dev ether1.2115
1822: ether1.2115@ether1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc
noqueue state UP group default qlen 1000
    inet 100.64.1.114/30 brd 100.64.1.115 scope global ether1.2115
       valid_lft forever preferred_lft forever

ether9.3109 and ether1.2115 are 802.1q VLAN, I don't know if it's important.

The ether9.3109 interface receives traffic from forgotten hardware (tcpdump -e
-ni ether9 host 100.64.1.113):

10:57:08.861954 50:ff:20:26:fa:14 > Broadcast, ethertype 802.1Q (0x8100),
length 64: vlan 3109, p 0, ethertype ARP, Request who-has 100.64.1.114 tell
100.64.1.113, length 46

kernel reply is
1) exists, although the ether9.3109 interface does not contain 100.64.1.114
2) contain the MAC of ether9.3109:

10:57:08.861972 3c:ec:ef:4d:94:ee > 50:ff:20:26:fa:14, ethertype 802.1Q
(0x8100), length 46: vlan 3109, p 0, ethertype ARP, Reply 100.64.1.114 is-at
3c:ec:ef:4d:94:ee, length 28

# ip a| grep 100.64.1.114
    inet 100.64.1.114/30 brd 100.64.1.115 scope global ether1.2115

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.