What happens if a host on the network receives an IP packet with a MAC source address that differs from the MAC address in the local ARP table for that source IP?

The ARP table entry for that IP was and will be filled via an valid ARP response.

Now I have noticed that the receiving host (Ubuntu 18.04) does not send a reply packet (ICMP echo response or TCP SYN/ACK ...etc). No reply packet is leaving the interface.

The question is now for what reasons the host behaves this way. What checks are being made with the packet MAC and IP addresses, the local arp table and routing table etc.?


To clearify the scenario:

enter image description here

If host Hb sends a ping request to (host Ha), Ha receives an ICMP packet with source IP and the source MAC address is the MAC address of the router. But the ARP table of host Ha has an entry: -> Hb MAC address. Thus the MAC addresses differ!

  • Maybe someone can verify this behavior in his own lab. – fitcfitcfatc Jul 21 '19 at 8:45
  • I'll build the lab tomorrow and check this behavior. But the check the firewall and output of the nstat -az command on the ubuntu host. – Anton Danilov Jul 21 '19 at 14:53
  • @AntonDanilov i do not understand your second sentence. – fitcfitcfatc Jul 21 '19 at 19:36

This behavior is completely expected and related with the routing configuration of the Hb host, that likely has only the default route through the router. So, if you haven't setup the additional route, the packets to the N2 network ( are sent through the default route.

So the issue is caused by enabled the reverse path filter on the Ha host, that drops the incoming packets by restrictions on the source address.

To troubleshoot this problem you should check the output of next commands on the Ha host:

  • ip netconf show dev <iface-N2> - check the rp_filter value. Likely it is strict.
  • ip route get from iif <iface-N2> - likely it will show something like invalid cross-device link.
  • nstat -az TcpExtIPReversePathFilter - likely it will have the non-zero value.

There are three oblivious ways to solve the issue:

  • Just disable the rp_filter on the Ha host with the sysctl (sysctl -w net.ipv4.conf.all.rp_filter=0 and sysctl -w net.ipv4.conf.<iface-N2>.rp_filter=0). Also, you should edit the /etc/sysctl.conf file to make this changes permanent.

  • Just add route on the Hb host to through address (command for linux ip route add via, for windows route add mask

  • Configurate the source address translation (NAT) on the router to rewrite the address of the Hb to the router address. The iptables rule to do it:

iptables -t nat -A POSTROUTING -o <iface-N2> --src --dst -j MASQUERADE
  • Perfect answer, thank you! – fitcfitcfatc Jul 22 '19 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.