When I run cat /proc/net/arp
I see two entries* bound to :
IP address HW type Flags HW address Mask Device
35.224.99.156 0x1 0x0 00:00:00:00:00:00 * docker0
35.222.85.5 0x1 0x0 00:00:00:00:00:00 * docker0
Even after ip -s -s neigh flush all
and arp -n
these entries come back. What do the results above mean?
Why is the ARP binding the docker0 device to an IPs (35.224.99.156) and (35.222.85.5) with mac 00:00:00:00:00:00
which I do not recognise all though they are from Google Cloud/Google or spoofed to be as such.
Is this expected, a bug or corruption or something more sinister?
*detected originally using OSQuery
SELECT address, mac, COUNT(mac) AS mac_count
FROM arp_cache GROUP BY mac
HAVING count(mac) > 1;
docker network inspect bridge
is
[
{
"Name": "bridge",
"Id": "REDACTED",
"Created": "2019-02-09T17:38:43.817882245Z",
"Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": null,
"Config": [
{
"Subnet": "172.17.0.0/16",
"Gateway": "172.17.0.1"
}
]
},
"Internal": false,
"Attachable": false,
"Ingress": false,
"ConfigFrom": {
"Network": ""
},
"ConfigOnly": false,
"Containers": {},
"Options": {
"com.docker.network.bridge.default_bridge": "true",
"com.docker.network.bridge.enable_icc": "true",
"com.docker.network.bridge.enable_ip_masquerade": "true",
"com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
"com.docker.network.bridge.name": "docker0",
"com.docker.network.driver.mtu": "1500"
},
"Labels": {}
}
]
*originally posted https://superuser.com/questions/1403215/arp-cache-mac-and-docker