I'm setting up a very basic IPS test, and wondering if an interface on a host pings an interface with a different IP address (of same network) on the same host, will it reply? Will it respond to ARP requests?

I have a setup where a linux box has two interfaces

  • eth1 -
  • eth2 -

Each of them are connected to an IPS (Intrustion Prevention Sensor) interface configured as a pair. In effect, eth1 is connected directly to eth2. No Sensing modes are activated.

TCPDUMP is run on the IPS, and on eth2.

if i send a ping from eth1 to eth2 by the command

ping -I eth2

It shows destination not reachable.

TCPDUMP on IPS shows that packet is flowing through. TCPDUMP on eth2 shows that arp packets are received, but eth2 sends no reply.

Is this because the source ip of the arp packet is from the same host? Is there any way to force eth2 to reply to the arp?


eth2 does not send a reply most likely because it is being sent by eth1. It is not necessarily the case that an ARP reply must be sent from the same interface from which it was received. I believe this is known as "ARP flux" and you may be able to find a solution to it here: http://wiki.openvz.org/Multiple_network_interfaces_and_ARP_flux

| improve this answer | |
  • had read that before. Does say anything if the ping is coming from the same interface. – woodstok Oct 9 '11 at 7:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.