netdev - Re: source IP address for ARP requests

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <alpine.LFD.2.00.1305072224040.1693@ja.ssi.bg>
Date:	Tue, 7 May 2013 22:33:14 +0300 (EEST)
From:	Julian Anastasov <ja@....bg>
To:	Michael Tokarev <mjt@....msk.ru>
cc:	netdev <netdev@...r.kernel.org>
Subject: Re: source IP address for ARP requests


	Hello,

On Tue, 7 May 2013, Michael Tokarev wrote:

> Hello.
> 
> With a somewhat unusual configuration:
> 
>  eth0  10.0.0.1/32
>  eth1  192.168.1.1/24
>  route add 10.0.0.2 dev eth1 src 10.0.0.1
> 
> namely, so that just one ip address is available
> on an "unrelated" subnet, with "our" address taken
> from another interface.
> 
> With this config, ARPs for 10.0.0.2 are sent to eth1
> with source address of 192.168.1.1, even if "src"
> is configured for the route in question:
> 
>  9:28:46.220680 ARP, Request who-has 10.0.0.2 tell 192.168.1.1, length 28
> 
> Is that right, or should the host send ARP requests
> with src=10.0.0.1?
> 
> This is kernel 3.2(.40).

	IIRC, it works in this way from 2.4+. I guess some
packet from 192.168.1.1 to 10.0.0.2 triggers such ARP request.
The kernel prefers to copy the addresses from IP header to
the ARP request, it can be tuned with arp_announce, you can
check Documentation/networking/ip-sysctl.txt

Regards

--
Julian Anastasov <ja@....bg>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html