2

When I run cat /proc/net/arp I see two entries* bound to :

IP address       HW type     Flags       HW address            Mask     Device
35.224.99.156    0x1         0x0         00:00:00:00:00:00     *        docker0
35.222.85.5      0x1         0x0         00:00:00:00:00:00     *        docker0

Even after ip -s -s neigh flush all and arp -n these entries come back. What do the results above mean?

Why is the ARP binding the docker0 device to an IPs (35.224.99.156) and (35.222.85.5) with mac 00:00:00:00:00:00 which I do not recognise all though they are from Google Cloud/Google or spoofed to be as such.

Is this expected, a bug or corruption or something more sinister?

*detected originally using OSQuery

SELECT address, mac, COUNT(mac) AS mac_count
  FROM arp_cache GROUP BY mac
  HAVING count(mac) > 1;

docker network inspect bridge is

[
   {
       "Name": "bridge",
       "Id": "REDACTED",
       "Created": "2019-02-09T17:38:43.817882245Z",
       "Scope": "local",
       "Driver": "bridge",
       "EnableIPv6": false,
       "IPAM": {
           "Driver": "default",
           "Options": null,
           "Config": [
               {
                   "Subnet": "172.17.0.0/16",
                   "Gateway": "172.17.0.1"
               }
           ]
       },
       "Internal": false,
       "Attachable": false,
       "Ingress": false,
       "ConfigFrom": {
           "Network": ""
       },
       "ConfigOnly": false,
       "Containers": {},
       "Options": {
           "com.docker.network.bridge.default_bridge": "true",
           "com.docker.network.bridge.enable_icc": "true",
           "com.docker.network.bridge.enable_ip_masquerade": "true",
           "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
           "com.docker.network.bridge.name": "docker0",
           "com.docker.network.driver.mtu": "1500"
       },
       "Labels": {}
   }
]
2
  • Include the docker network inspect bridge output. – BMitch Feb 8 '19 at 14:22
  • @BMitch post updated with output – Gridcell Coder Feb 9 '19 at 18:13
4

These are from connectivity-checks made by NetworkManager.

# nslookup connectivity-check.ubuntu.com
Server:         127.0.0.53
Address:        127.0.0.53#53

Non-authoritative answer:
Name:   connectivity-check.ubuntu.com
Address: 35.224.99.156
Name:   connectivity-check.ubuntu.com
Address: 35.222.85.5

There is a bug so the arp-request go out the wrong interfaces. See: https://bugzilla.redhat.com/show_bug.cgi?id=1634286

You can prevent this by removing the package network-manager-config-connectivity-ubuntu

apt purge network-manager-config-connectivity-ubuntu

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.