Wrong mac reported for 2 interfaces machine about arp-scan HOT 6 CLOSED

I think what you are seeing is a side-effect of proxy ARP, where a system will respond to ARP requests for the IP address of any of its interfaces. The mac address will always be the one connected to the segment you are scanning on.

from arp-scan.

That is one explantion but...

The answer is the same if I use a wifi interface on my latpop to do the scan.

I don't see proxy_arp enabled on that rpi (in /proc/sys/net/ipv4/conf/<iface>/proxy_arp) or in the wifi AP (running openwrt)

So the router may be ?

This should be closed ?

from arp-scan.

I think it may be a special case of proxy arp for local interfaces. I've seen this behaviour on linux systems with two Ethernet interfaces before, although it was a long time ago - maybe in the 2.6 kernel era. I'm not sure if there is a sysctl/proc control for this type of proxy arp.

No need to close until we've run out of ideas or solved the issue, as these sorts of unexplained issues can sometimes uncover interesting behaviour.

from arp-scan.

This serverfault thread seems to discuss the same behaviour:

https://serverfault.com/questions/834512/why-does-linux-answer-to-arp-on-incorrect-interfaces

from arp-scan.

Yes that's it.

On the target machine with 2 interfaces, as soon as I set net.ipv4.all.conf.arp_ignore to 1 or 2, it works as I excepted it in the output of arp-scan.

That's weird (to me at least) that it is not the default. From the point of view of the output of arp-scan it makes more sense that way. I don't know the internals of the (linux) kernel or it's ipv4 stack ...

The wikipedia link in the last comment is interesting: https://en.wikipedia.org/wiki/Host_model?oldformat=true

from arp-scan.

Well we've both learned something, which is good. I'll close this ticket now. Thanks for taking the time to report this behaviour.

from arp-scan.