I have a device running Debian Linux (Buster) that is connected to a neighbor device via a VLAN interface. The neighbor is sending ICMP echo replies to my device through that VLAN interface, but the Linux device is NOT sending ICMP echo requests. Is it possible (with some configuration tweaking) for the Linux device to learn the MAC address of the neighbor from these ICMP messages and create entries for them in the neighbor table (ip -4 neigh show), using some built-in Linux configuration settings?

Edit: The neighbor device is not sending any ARP/GARP packets to the Linux device, and I am not able to configure it to do so.

I have included abbreviated ip addr show output here, with more info:

284: Ethernet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9100 qdisc pfifo_fast master Bridge state UP group default qlen 1000
    link/ether 94:8e:d3:04:eb:28 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::968e:d3ff:fe04:eb28/64 scope link
       valid_lft forever preferred_lft forever

279: Vlan1000@Bridge: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9100 qdisc noqueue state UP group default qlen 1000
    link/ether 00:aa:bb:cc:dd:ee brd ff:ff:ff:ff:ff:ff
    inet brd scope global Vlan1000
       valid_lft forever preferred_lft forever
    inet6 fc02:1000::1/64 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::2aa:bbff:fecc:ddee/64 scope link
       valid_lft forever preferred_lft forever

The ICMP echo replies are being sent to Vlan1000 (the destination MAC is the VLAN's MAC address). tcpdump on Vlan1000 shows the ICMP echo replies, and I am able to see the neighbor MAC as the destination MAC. Is there someway to automatically learn the neighbor MAC in the ARP table?

  • The protocol to learn MAC addresses for IP addresses is called ARP. For some reason, your Linux device does not see the ARP packets from your neighbor device. Please add more information about your network topology and output of ip a to the question. – Tero Kilkanen Feb 16 at 22:01
  • There are no ARP/gratuitous ARP packets being sent. I was wondering if the source MAC field of the ICMP packets could somehow be used to learn the MAC information instead. – theasianpianist Feb 16 at 22:16
  • I am really curious how it happened that you see echo replies while claiming that your Linux system is NOT sending echo requests. If I were to guess I would say you have either broken routing or asymetric routing, You probably should elaborate a bit more about your network setup (diagram would be very helpful). – Tomek Feb 16 at 22:37
  • This asymmetry is by design - unfortunately I cannot share more information since this is work-related. I just need to find a way to populate the ARP table using the ICMP echo replies. – theasianpianist Feb 16 at 22:39
  • To me, the neighbor device looks quite broken and you will have other serious problems with it even if you can solve this. – Tero Kilkanen Feb 17 at 16:00

With simply tweaking configuration, you can't achieve what you want. The problem here is that arp entries are created only if the kernel receives a request to send packages. In this case, if the MAC address of the target is unknown, the kernel will send ARP requests, and parse the answers.

When packages (other than responses to the ARP request) arrive, no arp entries are added, not to mention that the packages in your case are actually garbage, as noone requested them.

What you need is more of a hack than a normal operation. You need to write a program which intercepts the sent ICMP packages, and somehow extracts the MAC address from them, then inserts it into the ARP table.

The "simple" way to do it is to listen to ICMP reply packages, extract the IP, and try to connect to that IP. This way the kernel will ask the MAC address of the device and will insert it into the ARP table.

If the device refuses to send ARP packets even in the case of an ARP request, then the solution becomes an even uglier hack. In this case, you need to listen to the raw packages, extract the headers yourself, find the source MAC, and insert it into the ARP table using an ioctl (SIOCSARP) call.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.