Hello, On Mon, 17 Mar 2003, Arno Griffioen wrote: > There seems to be one snag: Incorrect ARP source address. > > If there is no ARP entry for the gateway yet (no traffic has gone out, routes > learned from another BGP peer) and I try to reach a remote address immediately > then the ARP request that goes out on the 10.0.0.0 network for the > correct gateway does *not* contain the 10.0.0.2 source address, but > instead 17.70.0.1. > > Well.. That obviously does not work as this IP address does not occur on > this LAN and as a reasult most other routers will (correctly) ignore this. No, the router should answer this request because it knows where 17.70.0.1 is: it is on the LAN or at least reachable via gateway on this LAN. So, what is the good reason to ignore ARP requests with src 17.70.0.1? Linux ARP follows the routing and will reply in this case (when used in place of the router). > If I try to connect to the correct gateway on a 10.0.0.x adress directly > then it does work as it will use the correct 10.0.0.2 source for it's > ARP request. Correct > It seems that the ARP code also chooses the 'global' scope address for the > ARP request, while it should really always choose the 'link' address > of this interface as the source of the broadcast. No, the check is: is the source address in the IP packet local? If yes, use it as src for ARP - classic case where ARP must be accepted in router if the IP packets are accepted: if you have the right to send IP packets with src=17.70.0.1 is there a reason to ignore ARP with same src? In your case there is no reason, of course, there are other cases where tuning the ARP protocol is needed. > I have now temporarily fixed this by either adding some static ARP entries > or ARP-table filtering using iptables, but I feel that's only a temporary > measure. You are in the right direction, there are no many solutions to handle such case. The problem comes only if "router decides not to accept ARP from valid source IP from valid input device". > Have I overlooked something in my setup or should I start poking in the > kernel ARP code? Take a look at arp_solicit() Regards -- Julian Anastasov <ja@xxxxxx>
