Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is very strange.

Output of ip route show:

default via dev eth0 metric 100 dev eth1 proto kernel scope link src dev eth2 proto kernel scope link src dev eth0 proto kernel scope link src dev virbr0 proto kernel scope link src

From the firewall logs: (slightly shortened)

Mar 8 09:17:12 vmhost kernel: [ 562.808036] ''IN-dmz-lan-face':'IN=eth1 OUT= MAC=... SRC= DST= LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=28218 DF PROTO=TCP SPT=47365 DPT=22 WINDOW=14600 RES=0x00 SYN URGP=0

Notice the wacky discrepancy?

The firewall log lists eth1 at the address, but the routing table puts it at

Somehow, eth1 and eth0 are getting swapped, or their ip addresses are.

There are no extra routing tables in play.

How can this happen? How can I fix it?

Edit (more info)

Output of ip addr | grep "inet ":

inet scope host lo
inet brd scope global eth0
inet brd scope global eth1
inet brd scope global eth2
inet brd scope global virbr0
share|improve this question
Which linux version, which iptables version, which iproute2 version. – Soham Chakraborty Mar 8 '13 at 18:22
1) Ubuntu 12.04, kernel 3.2.0; 2) iptables 1.4.12; 3) iproute2 ss111117 – David Mar 8 '13 at 18:25
Could you add the result of : ip addr | grep "inet " – Dom Mar 8 '13 at 18:30
Info added! Thanks! – David Mar 8 '13 at 18:35
up vote 2 down vote accepted

There is no discrepancy.


The firewall log lists eth1 at the address, but the routing table puts it at

No, the firewall tell you it has received a packet from eth1 with destination This is not surprising: anyone on your network can send any bogus packet on the interface on which your server is connected. If this is a problem, blame the sender.

Note that, however, that the Linux kernel use a weak host model by default. That mean it will accept a packet as his own if the destination address match one on any of its interface. So the kernel will accept the packet as legitimate.

This weak host model is also reflected on ARP behaviour: the kernel will answer an ARP for the address on any of its interface by default. If all interfaces are connected to the same network segment, then someone requesting may end up on any of your 3 interfaces. If this is not wanted, set the arp_ignore sysctl to 1.

Also, your routing tables are unusual, if not wrong. If you ask the kernel to connect to, what interface should it use ? The actual answer is given by the ip route get command. It may not be the one you expect.

share|improve this answer
Aha! After asking the question, I realized that it had to be something to do with ARP and MAC address binding, but I knew nothing about host-model versus interface-model networking! Indeed, what I was trying to do may not be possible using linux ipv4. Thank you! – David Mar 8 '13 at 22:28
@David: With some configuration, you can "emulate" a interface-model networking on Linux with policy routing. But you have to be more specific. – BatchyX Mar 9 '13 at 10:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.