Looking at Kernel source code I see that when processing ARP request the net_device
is retrieved right from the skb
, and then seems like the reply is sent to that device (arp.c#L679):
static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
{
struct net_device *dev = skb->dev;
...
arp_send_dst(ARPOP_REPLY, ETH_P_ARP,
sip, dev, tip, sha,
dev->dev_addr, sha,
reply_dst);
}
But if the packet went through bridge, then skb
got its device overwritten with bridge device:
static int br_pass_frame_up(struct sk_buff *skb)
{
...
skb->dev = brdev;
...
}
Shouldn't it some how retrieve the original device and send the reply there?