I have a bridge set up on a Ubuntu box using two ethernet devices. It seems to work, but I am trying to understand some network traffic, and why these show up in my dhcp client list (/var/lib/dhcp/ is empty) in addition to the box's ip address. Also, I seem to have traffic originating from various mac addresses, which I was not expecting.

brctl showmacs br0 lists 16 unique mac addresses, and that is not making sense to me. I've read these non-local addresses might correspond to other devices, VMs, etc., on the network that pass traffic through the bridge? But I've looked at a couple of these mac addresses on the bridge (which show traffic on my network edge), and I cannot trace them back to a device on my network. The network is small, and I believe all devices are accounted for.

So how many mac addresses should I expect to see associated with a bridge?

  • 1
    The bridge bridges multiple networks. Can you account everything on both networks? – A.B Jun 2 '18 at 16:21
  • Yes. The bridge connects between my wireless access port and my edge router. I had set it up to experiment with network monitoring. The edge route is not open to incoming connections. – tim.rohrer Jun 2 '18 at 16:48
  • 1
    @A.B, Thanks for your comment/question. Being more confident that what I had read about the mac addresses relating to devices that had passed traffic through them, I went back and surveyed all the devices. I'm now down to two unidentified mac addresses on the bridge. I'll continue to search. – tim.rohrer Jun 2 '18 at 17:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.