Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have this situation: A router, which is an Ubuntu VM, has multiple VLAN interfaces on the same physical NIC. Those VLAN interfaces are dynamically configured and torn down and attached to networks where machines can be added or removed by users.

Sometimes we have a situation where, for example, on VLAN 1 the router has the IP and a neighbor machine has the IP While, at the same time, on VLAN 2 the router has the IP and a neighbor machine has the IP

When, on VLAN 1 is sending an ARP asking "who has tell" the router does not respond. Sniffing traffic on the router shows that the ARP requests arrive with proper VLAN tagging but are discarded.

Does the router discard the ARP message thinking that it arrived in the wrong interface?

A few notes:

  1. On VLAN 2 there are no ARP problems.
  2. Replacing the IP of the neighbor VM on VLAN 1 ( to solves the problem.
  3. As I mentioned, both IP's ( and are on the same MAC address.
  4. arp_filter is set to 0 on all interfaces
  5. the router's routing table does not refer all those dynamic interfaces. we use iptables and fwmarks along with IP rules and custom routing tables (all are dynamically set by software) to route traffic separately according to the VLAN it is originated.

Where is the problem?

share|improve this question
Why you have not on every VLAN one subnet of network, for example: VLAN1:, VLAN2: – Jan Marek Apr 23 '13 at 13:28
this is because the networks and hosts settings are dynamic. Networks and hosts may appear and disappear as users create them. And anyways, isn't that what VLANs are all about? Separating the same network to several logical networks? – Ido Apr 24 '13 at 4:54
No. VLANs are for dividing the same network to the separated segments to protect some sources againts some users - for example servers for financial reports against technology users and vice versa. But you have to have network well segmented - it's a good advice, trust me. You will not have this type of questions... And you can have dynamically added and removed host on the every segment you want - use dhcp server. – Jan Marek Apr 24 '13 at 8:54
Those are not options for us. The fact that we do not control IP's and that IP's are set statically is a given. All I have for isolating the networks is VLAN tagging and the actual VLAN that the machines get connected to (this we do control programmatically). – Ido Apr 24 '13 at 10:39

Having a single network node connect to two different networks that use the same IP addresses is not a supported configuration. Address conflicts is a well known shortcoming of using RFC 1918 addresses. This is the reason why RFC 4193 was introduced and specifies that 40 of the address bits must be randomly generated.

If you don't want to renumber the networks to solve the address conflict, and if you don't want to upgrade to IPv6, which avoids such conflicts happening in the first case, then the most reliable setup you can get is from splitting that single network node into two or more network nodes.

A single Linux VM can operate as multiple independent network nodes simultaneously. That feature is called network namespaces. Each network namespace has its own set of network interfaces, local addresses, routing table entries, and firewall rules. The different network namespaces can communicate with each other through virtual network interfaces.

Documentation on the network namespaces feature can be found using man ip-netns (or man ip if you are using an older version.)

share|improve this answer

If the router has the IP address on one of its interfaces, then another machine claiming to have that IP address is considered to be ARP spoofing. Even if you did get it to answer ARP, you'd never be able to send packets from the router to - what would the routing table look like?

You need to give the router and everything it's connected to distinct IP addresses.

share|improve this answer
the router's routing does not refer all those dynamic interfaces. we use iptables and fwmarks along with IP rules and custom routing tables to route traffic separately according to the VLAN it is originated from (updating the question with this info). – Ido Apr 24 '13 at 4:59

It sounds like your user's machines are not configured to send out gratuitous ARP requests when they are initially created or when an IP is newly assigned to them. You can accomplish such thing using the arping utility.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.