1

I have a simple xen project 4.1 setup running on debian wheezy dom0. I have noticed during a network scan that a domU gateway returned 2 mac addresses for the same IP. One MAC being the expected, XenSource Vendor, address which is randomly generated when the domU is created. The other is the hardware, SuperMicro Vendor, mac address.

In the dom0 ./interfaces, i initialize the physical interface as manual. I initialize the bridge as static and add the physical interface to it.

In my domU .cfg I declare the previously defined dom0 bridge as an interface. At this point, from my understanding, any packet generated on the domU is tagged with the auto-generated(no, i did not explicitly declare a MAC in the .cfg), XenSource Vendor, MAC address.

How is it possible for the real SuperMicro MAC address to show up?

This stems from my attempts to diagnose an intermittent connectivity problem, which im now led to believe may be some kind of arp cache poisoning from my xen machine.

ifconfig

eth1      Link encap:Ethernet  HWaddr 0c:c4:7a:00:c6:25  
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:852986 errors:0 dropped:0 overruns:0 frame:0
      TX packets:1295501 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000 
      RX bytes:152249020 (145.1 MiB)  TX bytes:1616503376 (1.5 GiB)
      Memory:f7100000-f7180000

brctl

bridge name bridge id       STP enabled interfaces
xenbr0      8000.feffffffffff   no      vif6.0
xenbr1      8000.0cc47a00c625   no      eth1
                                        vif6.1
xenbr2      8000.feffffffffff   no      vif6.2
                                        vif7.0
xenbr3      8000.6805ca213b95   no      eth2
                                        vif6.3

eth1 is the interface in question. Thx.

N.Balauro
  • 41

1 Answers1

0

FYI. Here is where i messed up.

In the dom0 ./interfaces, i initialize the physical interface as manual. I initialize the bridge as static and add the physical interface to it.

The bridge was created with a static IP assigned - the same one the domU claimed with, a different virtual mac address though.

Long story short, tcpdump showed both the bridge and domU replying to the same arp requests with different macs. Change the bridge from static to manual. Restart.

tcpdump now shows only the rebroadcasting of arp to the otherside of the bridge.

N.Balauro
  • 41