0

I have computer with the IP address: 10.0.0.1 and a another router in the same network, WAN is: 10.0.0.5 and LAN is 192.168.10.1

When I'm typing route add 192.168.1.0 mask 255.255.255.0 10.0.0.1 and I'm pinging to 192.168.10.1, I am getting a response. But how in the ARP list can I see 192.168.10.1 MAC address?

And then I'm pinging 10.0.0.5 and I'm getting the same MAC address. MAC address works on layer 2 and 10.0.0.5 is on layer 2 but 192.168.10.1 is not layer 2.

Thanks for the help

DIAGRAM

Improve this question
5
  • Your question is unclear. Specifically why would your computer have a WAN subnet IP address? I suspect that "proxyarp" might be part of the answer but I guess that depends on your question. (See en.wikipedia.org/wiki/Proxy_ARP)
    – davidgo
    Commented Apr 27, 2023 at 10:39
  • this is another router in the network
    – mikuzan
    Commented Apr 27, 2023 at 10:40
  • You might want to provide a network diagram.
    – davidgo
    Commented Apr 27, 2023 at 10:41
  • This is confusing route add 192.168.1.0 mask 255.255.255.0 10.0.0.1, do you mean ... 10.0.0.5 instead? Could you share the output of ip addr show, ip route list and tcpdump -i any -n icmp or arp? (start the tcpdump command while the arp table does not have the 192.168.10.1 entry yet, and run it while you are doing ping to that address).
    – gepa
    Commented Apr 27, 2023 at 11:51
  • actually, based on the syntax it seems like you are on a windows system, but still, if you can provide similar information (interface config, routes, and some packet dump showing arp and icmp packets), that would be helpful.
    – gepa
    Commented Apr 27, 2023 at 11:55

1 Answer 1

Reset to default
0
L3 – Ping requests to an "other network" address

You can ping addresses belonging to other interfaces of a router because it is in fact a router and will forward packets from one network to another, as that's its job.

L2 – ARP replies for "other network" addresses showing up

That's a peculiarity of the Linux TCP/IP stack. It will indeed respond to ARP requests for IP addresses that are assigned to any of its interfaces (but, of course, with a MAC address appropriate to the L2 network that it's responding to).

Set the sysctl net.ipv4.conf.all.arp_ignore=1 to switch it to the expected behavior (if you want to configure this permanently, see man sysctl.d).

(The broader explanation is that some IP stacks, including the one in Linux, operate in the "weak host" mode (if that is the right term) and treat the addresses to be attached to the entire system rather than to a specific interface.)

Improve this answer
1
  • That doesn't explain why 10.0.0.1 is getting 192.168.10.1 in its ARP table, since it never did an ARP request for that (it has a route to go to 192.168.10.1 through 10.0.0.5, so the only ARP request happening there is for 10.0.0.5). My guess is that there is some ICMP redirect message involved, e.g. the router telling the PC (you can reach 192.168.10.1 directly here instead of through 10.0.0.5), and the kernel then doing an ARP request for 192.168.10.1 on that interface. But this is just a guess, to be sure an output of tcpdump -i any -n icmp or arp would help clarify.
    – gepa
    Commented Apr 27, 2023 at 11:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .