arplookup x.x.x.x failed: host is not on local network
cswiger at mac.com
Sat Jul 5 16:57:17 UTC 2008
David DeSimone wrote:
[ ... ]
> Again, I did see these messages in my environment, but in my case, the
> error was correct: The IP *was not* on the local network. The reason
> being that we had multiple subnets configured on the same broadcast
> domain, so the BSD box could indeed hear ARP for subnets it did not know
> about. I don't know why the box feels moved to complain about this,
> however. I would think it should not care.
It's good practice for machines intended to be on different subnets to be in
different collision domains. Seeing traffic to or from the wrong network
should be considered a potential "red flag", warning that there might be a
network misconfiguration that could compromise security.
In particular, if you want to securely host a bunch of client machines,
setting them up on individual /30 subnets using a multiport firewall or a BSD
box with a couple of 4-port NIC cards, rather than a switch, is a good idea.
While this situation is something which is supposedly well-suited for VLANs,
in practice most switches cannot be relied upon to actually prevent traffic
from leaking outside of the specified VLAN.
This is more common for ARP traffic, which is sent to the all-ones MAC and may
well get forwarded to all ports regardless of VLAN tagging, particularly if
the switch is under load and has switched to some kind of "fast forwarding"
mode or if it tends to consider all ports trunk ports by default or via
dubious autolearning algorithms....
More information about the freebsd-net