ARP cache MAC and Dockerwhy do I get a different MAC address using arp and ifconfig?IP Address in ARP...

Need help with a circuit diagram where the motor does not seem to have any connection to ground. Error with diagram? Or am i missing something?

Website seeing my Facebook data?

Caron Accent v{a} doesn't render without usepackage{xeCJK}

What is the draw frequency for 3 consecutive games (same players; amateur level)?

Why are samba client and NFS client used differently?

Does the ditching switch allow an A320 to float indefinitely?

Is the fingering of thirds flexible or do I have to follow the rules?

hrule into tikz circle node

Should a cast be used to truncate a long variable?

Allow console draw poker game to output more hands

Writing dialogues for characters whose first language is not English

Is there a non-trivial covering of the Klein bottle by the Klein bottle?

Is there a file that always exists and a 'normal' user can't lstat it?

What species should be used for storage of human minds?

Concatenating two int[]

Renting a 2CV in France

To be or not to be - Optional arguments inside definition of macro

Why does 0.-5 evaluate to -5?

How to not let the Identify spell spoil everything?

Sitecore 9.1 Installation - Skip to particular step

Is Screenshot Time-tracking Common?

Is there any danger of my neighbor having my wife's signature?

What can I do to encourage my players to use their consumables?

Boss asked me to sign a resignation paper without a date on it along with my new contract



ARP cache MAC and Docker


why do I get a different MAC address using arp and ifconfig?IP Address in ARP CacheCannot delete entry from ARP cacheArp Address MismatchIs my arp cache poisoned?Can't Delete ARP Cache on Windows 7 x64ARP Cache location on windows 10Where is the ARP cache on Linux?In WLAN network, does ARP always show the mac address of device's Wi-Fi interface?Make an ARp table using fake IP and Fake MAC













2















When I run cat /proc/net/arp I see two entries* bound to :



IP address       HW type     Flags       HW address            Mask     Device
35.224.99.156 0x1 0x0 00:00:00:00:00:00 * docker0
35.222.85.5 0x1 0x0 00:00:00:00:00:00 * docker0


Even after ip -s -s neigh flush all and arp -n these entries come back. What do the results above mean?



Why is the ARP binding the docker0 device to an IPs (35.224.99.156) and (35.222.85.5) with mac 00:00:00:00:00:00 which I do not recognise all though they are from Google Cloud/Google or spoofed to be as such.



Is this expected, a bug or corruption or something more sinister?



*detected originally using OSQuery



SELECT address, mac, COUNT(mac) AS mac_count
FROM arp_cache GROUP BY mac
HAVING count(mac) > 1;


docker network inspect bridge is



[
{
"Name": "bridge",
"Id": "REDACTED",
"Created": "2019-02-09T17:38:43.817882245Z",
"Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": null,
"Config": [
{
"Subnet": "172.17.0.0/16",
"Gateway": "172.17.0.1"
}
]
},
"Internal": false,
"Attachable": false,
"Ingress": false,
"ConfigFrom": {
"Network": ""
},
"ConfigOnly": false,
"Containers": {},
"Options": {
"com.docker.network.bridge.default_bridge": "true",
"com.docker.network.bridge.enable_icc": "true",
"com.docker.network.bridge.enable_ip_masquerade": "true",
"com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
"com.docker.network.bridge.name": "docker0",
"com.docker.network.driver.mtu": "1500"
},
"Labels": {}
}
]









share|improve this question

























  • Include the docker network inspect bridge output.

    – BMitch
    Feb 8 at 14:22











  • @BMitch post updated with output

    – Gridcell Coder
    Feb 9 at 18:13
















2















When I run cat /proc/net/arp I see two entries* bound to :



IP address       HW type     Flags       HW address            Mask     Device
35.224.99.156 0x1 0x0 00:00:00:00:00:00 * docker0
35.222.85.5 0x1 0x0 00:00:00:00:00:00 * docker0


Even after ip -s -s neigh flush all and arp -n these entries come back. What do the results above mean?



Why is the ARP binding the docker0 device to an IPs (35.224.99.156) and (35.222.85.5) with mac 00:00:00:00:00:00 which I do not recognise all though they are from Google Cloud/Google or spoofed to be as such.



Is this expected, a bug or corruption or something more sinister?



*detected originally using OSQuery



SELECT address, mac, COUNT(mac) AS mac_count
FROM arp_cache GROUP BY mac
HAVING count(mac) > 1;


docker network inspect bridge is



[
{
"Name": "bridge",
"Id": "REDACTED",
"Created": "2019-02-09T17:38:43.817882245Z",
"Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": null,
"Config": [
{
"Subnet": "172.17.0.0/16",
"Gateway": "172.17.0.1"
}
]
},
"Internal": false,
"Attachable": false,
"Ingress": false,
"ConfigFrom": {
"Network": ""
},
"ConfigOnly": false,
"Containers": {},
"Options": {
"com.docker.network.bridge.default_bridge": "true",
"com.docker.network.bridge.enable_icc": "true",
"com.docker.network.bridge.enable_ip_masquerade": "true",
"com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
"com.docker.network.bridge.name": "docker0",
"com.docker.network.driver.mtu": "1500"
},
"Labels": {}
}
]









share|improve this question

























  • Include the docker network inspect bridge output.

    – BMitch
    Feb 8 at 14:22











  • @BMitch post updated with output

    – Gridcell Coder
    Feb 9 at 18:13














2












2








2








When I run cat /proc/net/arp I see two entries* bound to :



IP address       HW type     Flags       HW address            Mask     Device
35.224.99.156 0x1 0x0 00:00:00:00:00:00 * docker0
35.222.85.5 0x1 0x0 00:00:00:00:00:00 * docker0


Even after ip -s -s neigh flush all and arp -n these entries come back. What do the results above mean?



Why is the ARP binding the docker0 device to an IPs (35.224.99.156) and (35.222.85.5) with mac 00:00:00:00:00:00 which I do not recognise all though they are from Google Cloud/Google or spoofed to be as such.



Is this expected, a bug or corruption or something more sinister?



*detected originally using OSQuery



SELECT address, mac, COUNT(mac) AS mac_count
FROM arp_cache GROUP BY mac
HAVING count(mac) > 1;


docker network inspect bridge is



[
{
"Name": "bridge",
"Id": "REDACTED",
"Created": "2019-02-09T17:38:43.817882245Z",
"Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": null,
"Config": [
{
"Subnet": "172.17.0.0/16",
"Gateway": "172.17.0.1"
}
]
},
"Internal": false,
"Attachable": false,
"Ingress": false,
"ConfigFrom": {
"Network": ""
},
"ConfigOnly": false,
"Containers": {},
"Options": {
"com.docker.network.bridge.default_bridge": "true",
"com.docker.network.bridge.enable_icc": "true",
"com.docker.network.bridge.enable_ip_masquerade": "true",
"com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
"com.docker.network.bridge.name": "docker0",
"com.docker.network.driver.mtu": "1500"
},
"Labels": {}
}
]









share|improve this question
















When I run cat /proc/net/arp I see two entries* bound to :



IP address       HW type     Flags       HW address            Mask     Device
35.224.99.156 0x1 0x0 00:00:00:00:00:00 * docker0
35.222.85.5 0x1 0x0 00:00:00:00:00:00 * docker0


Even after ip -s -s neigh flush all and arp -n these entries come back. What do the results above mean?



Why is the ARP binding the docker0 device to an IPs (35.224.99.156) and (35.222.85.5) with mac 00:00:00:00:00:00 which I do not recognise all though they are from Google Cloud/Google or spoofed to be as such.



Is this expected, a bug or corruption or something more sinister?



*detected originally using OSQuery



SELECT address, mac, COUNT(mac) AS mac_count
FROM arp_cache GROUP BY mac
HAVING count(mac) > 1;


docker network inspect bridge is



[
{
"Name": "bridge",
"Id": "REDACTED",
"Created": "2019-02-09T17:38:43.817882245Z",
"Scope": "local",
"Driver": "bridge",
"EnableIPv6": false,
"IPAM": {
"Driver": "default",
"Options": null,
"Config": [
{
"Subnet": "172.17.0.0/16",
"Gateway": "172.17.0.1"
}
]
},
"Internal": false,
"Attachable": false,
"Ingress": false,
"ConfigFrom": {
"Network": ""
},
"ConfigOnly": false,
"Containers": {},
"Options": {
"com.docker.network.bridge.default_bridge": "true",
"com.docker.network.bridge.enable_icc": "true",
"com.docker.network.bridge.enable_ip_masquerade": "true",
"com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
"com.docker.network.bridge.name": "docker0",
"com.docker.network.driver.mtu": "1500"
},
"Labels": {}
}
]






networking docker mac-address arp google-cloud-platform






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Feb 9 at 18:12







Gridcell Coder

















asked Feb 7 at 17:02









Gridcell CoderGridcell Coder

133




133













  • Include the docker network inspect bridge output.

    – BMitch
    Feb 8 at 14:22











  • @BMitch post updated with output

    – Gridcell Coder
    Feb 9 at 18:13



















  • Include the docker network inspect bridge output.

    – BMitch
    Feb 8 at 14:22











  • @BMitch post updated with output

    – Gridcell Coder
    Feb 9 at 18:13

















Include the docker network inspect bridge output.

– BMitch
Feb 8 at 14:22





Include the docker network inspect bridge output.

– BMitch
Feb 8 at 14:22













@BMitch post updated with output

– Gridcell Coder
Feb 9 at 18:13





@BMitch post updated with output

– Gridcell Coder
Feb 9 at 18:13










1 Answer
1






active

oldest

votes


















2














These are from connectivity-checks made by NetworkManager.



# nslookup connectivity-check.ubuntu.com
Server: 127.0.0.53
Address: 127.0.0.53#53

Non-authoritative answer:
Name: connectivity-check.ubuntu.com
Address: 35.224.99.156
Name: connectivity-check.ubuntu.com
Address: 35.222.85.5


There is a bug so the arp-request go out the wrong interfaces. See: https://bugzilla.redhat.com/show_bug.cgi?id=1634286



You can prevent this by removing the package network-manager-config-connectivity-ubuntu



apt purge network-manager-config-connectivity-ubuntu





share|improve this answer










New contributor




David Weber is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.




















    Your Answer








    StackExchange.ready(function() {
    var channelOptions = {
    tags: "".split(" "),
    id: "3"
    };
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function() {
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled) {
    StackExchange.using("snippets", function() {
    createEditor();
    });
    }
    else {
    createEditor();
    }
    });

    function createEditor() {
    StackExchange.prepareEditor({
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: true,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: 10,
    bindNavPrevention: true,
    postfix: "",
    imageUploader: {
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    },
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    });


    }
    });














    draft saved

    draft discarded


















    StackExchange.ready(
    function () {
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1403215%2farp-cache-mac-and-docker%23new-answer', 'question_page');
    }
    );

    Post as a guest















    Required, but never shown

























    1 Answer
    1






    active

    oldest

    votes








    1 Answer
    1






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    2














    These are from connectivity-checks made by NetworkManager.



    # nslookup connectivity-check.ubuntu.com
    Server: 127.0.0.53
    Address: 127.0.0.53#53

    Non-authoritative answer:
    Name: connectivity-check.ubuntu.com
    Address: 35.224.99.156
    Name: connectivity-check.ubuntu.com
    Address: 35.222.85.5


    There is a bug so the arp-request go out the wrong interfaces. See: https://bugzilla.redhat.com/show_bug.cgi?id=1634286



    You can prevent this by removing the package network-manager-config-connectivity-ubuntu



    apt purge network-manager-config-connectivity-ubuntu





    share|improve this answer










    New contributor




    David Weber is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
    Check out our Code of Conduct.

























      2














      These are from connectivity-checks made by NetworkManager.



      # nslookup connectivity-check.ubuntu.com
      Server: 127.0.0.53
      Address: 127.0.0.53#53

      Non-authoritative answer:
      Name: connectivity-check.ubuntu.com
      Address: 35.224.99.156
      Name: connectivity-check.ubuntu.com
      Address: 35.222.85.5


      There is a bug so the arp-request go out the wrong interfaces. See: https://bugzilla.redhat.com/show_bug.cgi?id=1634286



      You can prevent this by removing the package network-manager-config-connectivity-ubuntu



      apt purge network-manager-config-connectivity-ubuntu





      share|improve this answer










      New contributor




      David Weber is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.























        2












        2








        2







        These are from connectivity-checks made by NetworkManager.



        # nslookup connectivity-check.ubuntu.com
        Server: 127.0.0.53
        Address: 127.0.0.53#53

        Non-authoritative answer:
        Name: connectivity-check.ubuntu.com
        Address: 35.224.99.156
        Name: connectivity-check.ubuntu.com
        Address: 35.222.85.5


        There is a bug so the arp-request go out the wrong interfaces. See: https://bugzilla.redhat.com/show_bug.cgi?id=1634286



        You can prevent this by removing the package network-manager-config-connectivity-ubuntu



        apt purge network-manager-config-connectivity-ubuntu





        share|improve this answer










        New contributor




        David Weber is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
        Check out our Code of Conduct.










        These are from connectivity-checks made by NetworkManager.



        # nslookup connectivity-check.ubuntu.com
        Server: 127.0.0.53
        Address: 127.0.0.53#53

        Non-authoritative answer:
        Name: connectivity-check.ubuntu.com
        Address: 35.224.99.156
        Name: connectivity-check.ubuntu.com
        Address: 35.222.85.5


        There is a bug so the arp-request go out the wrong interfaces. See: https://bugzilla.redhat.com/show_bug.cgi?id=1634286



        You can prevent this by removing the package network-manager-config-connectivity-ubuntu



        apt purge network-manager-config-connectivity-ubuntu






        share|improve this answer










        New contributor




        David Weber is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
        Check out our Code of Conduct.









        share|improve this answer



        share|improve this answer








        edited 4 hours ago





















        New contributor




        David Weber is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
        Check out our Code of Conduct.









        answered 6 hours ago









        David WeberDavid Weber

        362




        362




        New contributor




        David Weber is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
        Check out our Code of Conduct.





        New contributor





        David Weber is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
        Check out our Code of Conduct.






        David Weber is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
        Check out our Code of Conduct.






























            draft saved

            draft discarded




















































            Thanks for contributing an answer to Super User!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid



            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.


            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1403215%2farp-cache-mac-and-docker%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            Popular posts from this blog

            Couldn't open a raw socket. Error: Permission denied (13) (nmap)Is it possible to run networking commands...

            VNC viewer RFB protocol error: bad desktop size 0x0I Cannot Type the Key 'd' (lowercase) in VNC Viewer...

            Why not use the yoke to control yaw, as well as pitch and roll? Announcing the arrival of...