Date: Sat, 05 Jul 2008 12:39:13 -0400 From: Chuck Swiger <cswiger@mac.com> To: freebsd-net@freebsd.org Subject: Re: arplookup x.x.x.x failed: host is not on local network Message-ID: <486FA3B1.6040806@mac.com> In-Reply-To: <20080704023244.GH29305@verio.net> References: <20080703115243.GR29380@server.vk2pj.dyndns.org> <20080703190513.5CD5D5B4C@mail.bitblocks.com> <20080704023244.GH29305@verio.net>
next in thread | previous in thread | raw e-mail | index | archive | help
David DeSimone wrote: [ ... ] > Again, I did see these messages in my environment, but in my case, the > error was correct: The IP *was not* on the local network. The reason > being that we had multiple subnets configured on the same broadcast > domain, so the BSD box could indeed hear ARP for subnets it did not know > about. I don't know why the box feels moved to complain about this, > however. I would think it should not care. It's good practice for machines intended to be on different subnets to be in different collision domains. Seeing traffic to or from the wrong network should be considered a potential "red flag", warning that there might be a network misconfiguration that could compromise security. In particular, if you want to securely host a bunch of client machines, setting them up on individual /30 subnets using a multiport firewall or a BSD box with a couple of 4-port NIC cards, rather than a switch, is a good idea. While this situation is something which is supposedly well-suited for VLANs, in practice most switches cannot be relied upon to actually prevent traffic from leaking outside of the specified VLAN. This is more common for ARP traffic, which is sent to the all-ones MAC and may well get forwarded to all ports regardless of VLAN tagging, particularly if the switch is under load and has switched to some kind of "fast forwarding" mode or if it tends to consider all ports trunk ports by default or via dubious autolearning algorithms.... Regards, -- -Chuck
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?486FA3B1.6040806>