Docker Community Forums

Share and learn in the Docker community.

ARP cache MAC and Docker


When I run cat /proc/net/arp I see two entries* bound to :

IP address       HW type     Flags       HW address            Mask     Device    0x1         0x0         00:00:00:00:00:00     *        docker0      0x1         0x0         00:00:00:00:00:00     *        docker0

Even after ip -s -s neigh flush all and arp -n these entries come back. What do the results above mean?

Why is the ARP binding the docker0 device to an IPs ( and ( with mac 00:00:00:00:00:00 which I do not recognise all though they are from Google Cloud/Google or spoofed to be as such.

Is this expected, a bug or corruption or something more sinister?

*detected originally using OSQuery

SELECT address, mac, COUNT(mac) AS mac_count
  FROM arp_cache GROUP BY mac
  HAVING count(mac) > 1;

docker network inspect bridge is

       "Name": "bridge",
       "Id": "REDACTED",
       "Created": "2019-02-09T17:38:43.817882245Z",
       "Scope": "local",
       "Driver": "bridge",
       "EnableIPv6": false,
       "IPAM": {
           "Driver": "default",
           "Options": null,
           "Config": [
                   "Subnet": "",
                   "Gateway": ""
       "Internal": false,
       "Attachable": false,
       "Ingress": false,
       "ConfigFrom": {
           "Network": ""
       "ConfigOnly": false,
       "Containers": {},
       "Options": {
           "": "true",
           "": "true",
           "": "true",
           "": "",
           "": "docker0",
           "": "1500"
       "Labels": {}

*originally posted