让网卡学会闭嘴:四行 ARP 参数的源码真相

if (addr_type == RTN_LOCAL) {         int dont_send;          dont_send = arp_ignore(in_dev, sip, tip);   // 回不回，这一行说了算         if (!dont_send && IN_DEV_ARPFILTER(in_dev))                 dont_send = arp_filter(sip, tip, dev);         if (!dont_send) {                 /* 更新邻居表，发 ARP 应答 */         } } 

static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip) {         struct net *net = dev_net(in_dev->dev);         int scope;          switch (IN_DEV_ARP_IGNORE(in_dev)) {         case 0: /* Reply, the tip is already validated */                 return 0;         case 1: /* Reply only if tip is configured on the incoming interface */                 sip = 0;                 scope = RT_SCOPE_HOST;                 break;         case 2: /*                  * Reply only if tip is configured on the incoming interface                  * and is in same subnet as sip                  */                 scope = RT_SCOPE_HOST;                 break;         case 3: /* Do not reply for scope host addresses */                 sip = 0;                 scope = RT_SCOPE_LINK;                 in_dev = NULL;                 break;         case 4: /* Reserved */         case 5:         case 6:         case 7:                 return 0;         case 8: /* Do not reply */                 return 1;         default:                 return 0;         }         return !inet_confirm_addr(net, in_dev, sip, tip, scope); } 

switch (IN_DEV_ARP_ANNOUNCE(in_dev)) { default: case 0:         /* By default announce any local IP */         if (skb && inet_addr_type_dev_table(dev_net(dev), dev,                                           ip_hdr(skb)->saddr) == RTN_LOCAL)                 saddr = ip_hdr(skb)->saddr;         break; case 1:         /* Restrict announcements of saddr in same subnet */         if (!skb)                 break;         saddr = ip_hdr(skb)->saddr;         if (inet_addr_type_dev_table(dev_net(dev), dev,                                      saddr) == RTN_LOCAL) {                 /* saddr should be known to target */                 if (inet_addr_onlink(in_dev, target, saddr))                         break;         }         saddr = 0;         break; case 2:         /* Avoid secondary IPs, get a primary/preferred one */         break; } rcu_read_unlock();  if (!saddr)         saddr = inet_select_addr(dev, target, RT_SCOPE_LINK); 

#define IN_DEV_MAXCONF(in_dev, attr) \         (max(IPV4_DEVCONF_ALL_RO(dev_net(in_dev->dev), attr), \              IN_DEV_CONF_GET((in_dev), attr)))  #define IN_DEV_ARP_ANNOUNCE(in_dev)  IN_DEV_MAXCONF((in_dev), ARP_ANNOUNCE) #define IN_DEV_ARP_IGNORE(in_dev)    IN_DEV_MAXCONF((in_dev), ARP_IGNORE) 

sysctl -w net.ipv4.conf.all.arp_ignore=1 sysctl -w net.ipv4.conf.eth0.arp_ignore=1 sysctl -w net.ipv4.conf.all.arp_announce=2 sysctl -w net.ipv4.conf.eth0.arp_announce=2 

net.ipv4.conf.all.arp_ignore = 1 net.ipv4.conf.eth0.arp_ignore = 1 net.ipv4.conf.all.arp_announce = 2 net.ipv4.conf.eth0.arp_announce = 2 

# 1. 看值落没落下去 sysctl net.ipv4.conf.all.arp_ignore net.ipv4.conf.eth0.arp_ignore  # 2. 在另一台同网段机器上问 VIP，看谁应答——金标准 arping -I eth0 -c 3 10.0.0.100  # 3. 在 RS 上抓 ARP 包，确认自己没抢答 tcpdump -i eth0 -n arp