I have a Linux system with 3 dedicated NICs & all 3 are on the same subnet with the following IPs


I've setup three routing tables & corresponding IP routes & rules to isolate the traffic of the 3 ports. Shown below is the same for ETH1. ETH0 & ETH2 have similar entries as well.

default via dev eth1 dev eth1  src

32752:  from all to lookup 1
32753:  from lookup 1

If ETH1 & ETH2 are disconnected while ETH0 is connected, when I ping ETH1 & ETH2 IPs, I get a response from ETH0. In another question, Ghost ping on a multi-NIC Linux system I found out that this is caused by the ARP table being populated with the same MAC address for all 3 ports.

I've set arp_ignore & arp_announce as specified here Ubuntu Linux - multiple NICs, same LAN… ARP responses always go out a single NIC & I can see the ARP entries on the PC containing the correct MAC addresses.

However, I still see that only one port becomes the "default" in this circumstance. This can be seen very easily when say ETH1 & ETH2 are already connected and the cable for ETH0 is now plugged in but ETH0 is connected to an isolated switch (which has no connection to the subnet). Now, ETH0 becomes the default & due to the isolation, pings to ETH1 & ETH2 also fail.

Is there a way I can truly isolate the traffic on the three ports?

  • Do you see if bonding (also named link aggregation) is not a better solution ? You will aggregate the 3 links if the switch allow this and a failure on one or two link will not discard any packet.
    – Dom
    Mar 14, 2018 at 10:48
  • That's an option but unfortunately, it doesn't work out in my case. I actually need connectivity corresponding to that IP to be cut off if the cable is disconnected, i.e. I want the packets to be dropped on the disconnected interface. Bonding would be counterproductive to this. Mar 15, 2018 at 3:08


You must log in to answer this question.

Browse other questions tagged .