Will ip route affect ARP protocol?

Question

I created a macvlan network interface mac0 on my host. My docker container also joined a macvlan network which has the same parent interface as mac0.

After doing above steps, I still can not ping my mac0 ip from docker container. However, after adding one route to my host with this command:

ip route add <container_ip> dev mac0

I can ping mac0 ip successfully from my container.

Before adding the route, I use tcpdump -i mac0 host <mac0_ip> to see what's happening. It seem's that mac0 just don't reply the ARP request:

#tcpdump -i mac0 host 21.26.21.104
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on mac0, link-type EN10MB (Ethernet), capture size 262144 bytes
20:19:51.218288 ARP, Request who-has <host_name> tell 21.26.21.102, length 28
20:19:52.219645 ARP, Request who-has <host_name> tell 21.26.21.102, length 28
20:19:53.221646 ARP, Request who-has <host_name> tell 21.26.21.102, length 28

After adding the route:

#tcpdump -i mac0 host 21.26.21.104
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on mac0, link-type EN10MB (Ethernet), capture size 262144 bytes
20:21:46.318010 ARP, Request who-has <host_name> tell 21.26.21.102, length 28
20:21:46.318033 ARP, Reply <host_name> is-at <mac> (oui Unknown), length 28
20:21:46.318038 IP 21.26.21.102 > <host_name>: ICMP echo request, id 750, seq 1, length 64
20:21:46.318062 IP <host_name> > 21.26.21.102: ICMP echo reply, id 750, seq 1, length 64

I know that the macvlan sub-interface can not communicate with parent interface directly. What I don't know is why the ip route can affect the ARP protocol which I think is working on L2 network layer?

Answer 1

ARP is not a standalone protocol; it is used as a helper protocol by IP, in order to resolve layer-3 addresses into layer-2 addresses. While technically a generic protocol, it is practically always used for IPv4 only, and could almost be considered as being part of IPv4. (And for comparison, in IPv6 the same functionality is done in ICMPv6, which is arguably above IP.)

Since ARP is used to obtain the IP configuration, the IP stack has full authority on deciding which interfaces should receive which ARP responses. For example, some operating systems will respond to ARP queries for any address on any interface, while others restrict it to addresses from the same interface as the query. (On Linux you can select either behavior by changing "arp_ignore".)

Linux has several other ARP limiting sysctls, and one in particular is arp_filter, which—if enabled—tells the OS to ignore ARP queries if the requestor IP address would have been routed through a different interface. This seems similar to your problem.