26

When a network interface (e.g., eth0) is added to a Linux bridge (e.g., br0), the IP address must be removed from eth0 and added to br0 for the networking to function properly.

I recall reading in some Open vSwitch readme file (which I can't find right now) that moving the IP address is required because of how the Linux kernel is implemented. What is it about the implementation of Linux that requires the IP address be moved from the NIC to the bridge?

10

The NIC represents the uplink cable. A cable is layer 1, not layer 3.

Now the Bridge works as the device that is being addressed for network traffic (incoming) on the server - either on layer 2 (Ethernet/MAC) and/or layer 3 (IP).

So the device that responds to ARP-requests is the bridge - which is good, since it needs to distribute the traffic to the other interfaces on that bridge.

If the responding device were the NIC, traffic would not be passed further on to the bridge.

On some guides it is therefore even recommended to remove the MAC from the (uplink) NIC.

  • So, speaking about the actual linux mechanisms (not about good practices), it means that if I put an interface under a bridge, it is no longer considered by the kernel as a L2/L3 adressable interface ? right ? As nothing prevents from assigning it a MAC/IP, it's confusing. – Jocelyn delalande Oct 28 '13 at 9:37
  • 1
    @Jocelyn The other way around. If it is still addressable as L2/3 it will block the other traffic. So it should not be addressed directly if on a bridge. – Nils Oct 29 '13 at 20:26
  • ok, but by default the port remains adressable on L2 (keeps a MACaddr if I don't remove it), right ? why does it let the L2 traffic flow to the bridge ? – Jocelyn delalande Oct 30 '13 at 9:36
  • 2
    @Jocelyn As long as it does not respond to arp-requests everything will be good on l2/3. If it does not capture packets it will let pass packets into the network part of the kernel. – Nils Nov 2 '13 at 20:10
  • Ok. I asked cause I noticed that some trafic was dropped when assigning an address to the port ; but it was caused by rp_filter. – Jocelyn delalande Nov 4 '13 at 13:31
1

The bridge distributes the traffic to where it needs to go when multiple interfaces are in a bridge. More or less, the individual interfaces in the bridge are working on layer 2 now according to what the bridge determines, not independently on layer 3. So you want to address the bridge as a whole, not individual interfaces within it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.