Re: [PATCH net-next 1/2] bridge: Do not suppress ARP probes and DAD NS unconditionally

Nikolay Aleksandrov
2026-04-29T09:04:09Z

On 29/04/2026 09:24, Danielle Ratson wrote:
> When neighbor suppression is enabled on a VXLAN port, the bridge is
> expected to reply to ARP/NS messages on behalf of remote hosts when both
> FDB and neighbor entries exist. This allows the bridge to suppress
> flooding of these messages to the VXLAN overlay.
>
> According to RFC 9161 ("Operational Aspects of Proxy ARP/ND in Ethernet
> Virtual Private Networks"):
> "A PE SHOULD reply to broadcast/multicast address resolution messages,
> i.e., ARP Requests, ARP probes, NS messages, as well as DAD NS messages.
> An ARP probe is an ARP Request constructed with an all-zero sender IP
> address that may be used by hosts for IPv4 Address Conflict Detection as
> specified in [RFC5227]".
>
> However, the current implementation unconditionally suppresses ARP probes
> and DAD Neighbor Solicitations, which breaks Duplicate Address Detection
> (DAD) over EVPN.
>
> For DAD to work correctly over the VXLAN fabric:
> - When the bridge does not know the answer:
> flood the probe/DAD packet to allow remote VTEPs to respond.
> - When the bridge knows the answer:
> reply to indicate the address is in use.
>
> Fix by adjusting the early suppression checks to exclude ARP probes and
> DAD NS from unconditional suppression.
>
> When replying to a DAD NS, br_nd_send() is adjusted to set the NA
> destination to the all-nodes multicast address (ff02::1) and clear the
> Solicited flag, in accordance with RFC 4861 section 7.2.4.
>
> Reviewed-by: Ido Schimmel <idosch@nvidia.com>
> Signed-off-by: Danielle Ratson <danieller@nvidia.com>
> ---
> net/bridge/br_arp_nd_proxy.c | 16 +++++++++++-----
> 1 file changed, 11 insertions(+), 5 deletions(-)
>

Acked-by: Nikolay Aleksandrov <razor@blackwall.org>