KVM bridge networking: First ARP packet gets answered by wrong host

Question

I have a host (192.168.1.106) Linux server with KVM and one Linux server as virtualized guest (192.168.1.105). The guest uses a network bridge and both host and guest are reachable over the same network interface card.

My issue is that the first ARP packet asking for the IP of my virtualized guest, in this example 192.168.1.105 always gets answered by my host machine 192.168.1.106 with the wrong MAC address. The second ARP packet however always finds its way to the guest and gets answered correctly. Needles to say that this is something that brings trouble...

$ arping -I wlp4s0 192.168.1.105
ARPING 192.168.1.105 from 192.168.1.100 wlp4s0
Unicast reply from 192.168.1.105 [10:7B:44:80:E0:85]  3.752ms <-- Wrong MAC address
Unicast reply from 192.168.1.105 [52:54:00:8D:A2:C8]  3.838ms
Unicast reply from 192.168.1.105 [52:54:00:8D:A2:C8]  2.591ms

$ ip a
3: enp5s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 10:7b:44:80:e0:85 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.106/24 brd 192.168.1.255 scope global noprefixroute enp5s0
       valid_lft forever preferred_lft forever
    inet6 fe80::127b:44ff:fe80:e082/64 scope link 
       valid_lft forever preferred_lft forever
6: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 52:54:00:f9:4b:f9 brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
       valid_lft forever preferred_lft forever
7: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast master virbr0 state DOWN group default qlen 1000
    link/ether 52:54:00:f9:4b:f9 brd ff:ff:ff:ff:ff:ff
10: macvtap0@enp5s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 500
    link/ether 52:54:00:8d:a2:c8 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.105/24 brd 192.168.1.255 scope global noprefixroute macvtap0
       valid_lft forever preferred_lft forever
    inet6 fe80::5054:ff:fe8d:a2c8/64 scope link 
       valid_lft forever preferred_lft forever

virsh # iface-dumpxml macvtap0
<interface type='ethernet' name='macvtap0'>
  <mtu size='1500'/>
  <link speed='1000' state='up'/>
  <mac address='52:54:00:8d:a2:c8'/>
</interface>

virsh # iface-dumpxml enp5s0
<interface type='ethernet' name='enp5s0'>
  <mtu size='1500'/>
  <link speed='1000' state='up'/>
  <mac address='10:7b:44:80:e0:85'/>
</interface>

virsh # version
Compiled against library: libvirt 4.5.0
Using library: libvirt 4.5.0
Using API: QEMU 4.5.0
Running hypervisor: QEMU 3.0.0

Does someone have an idea what might be the problem? Or how to fix it? I also looked at a tcpdump from the guest and the first ARP packet never arrives there.

Answer 1

Your interface macvtap0 (linked to enp5s0) was assigned an IP: 192.168.1.105/24: VM's IP. Since Linux considers all of its IPs as a pool, including when querying/answering ARP, the host just did what should be done according to its configuration: answer queries to 192.168.1.105 set to macvtap0 using enp5s0's MAC.

That's the VM's role to receive traffic and using its own network stack answer to it accordingly. Really macvtap should be considered as a bridge port. The host shouldn't have this IP on its side, exactly like it wouldn't have an IP on a bridge port if one were used for this configuration.

You didn't show any configuration file having this IP, but it appears in the configured interface. So just remove 192.168.1.105/24 from macvtap0's setup, wherever it is, to correct this problem.