Sample Header Ad - 728x90

Why is 00:00:00:00:00:00 address used instead of broadcast address ff:ff:ff:ff:ff:ff in ARP?

0 votes
1 answer
375 views
The following is my stripped down ARP ruleset, only broadcast rules are shown, other rules (not shown here) are not relevant. Please see code comments that are questions (?)
#!/usr/sbin/nft -f

add chain arp arp_table input {
	# filter = 0
	# Packets delivered to the local system
	type filter hook input priority filter; policy drop;
}

add chain arp arp_table output {
	# filter = 0
	# Packets send by the local system
	type filter hook output priority filter; policy drop;
}

# ARP Broadcast address
define broadcast_ether = { ff:ff:ff:ff:ff:ff }

# IPv4 network address
define network_addr_4 = { 192.168.1.0/24 }

# NIC ether address
define physical_ether = { bb:c9:51:d4:4a:b6 }

# Why input to broadcast address never hits?
# This rule should handle broadcast input
add rule arp arp_table input arp daddr ether $broadcast_ether log prefix "ACCEPT input broadcast: " accept

# Why input to 00:00:00:00:00:00 hits instead?
# This rule handles input toward 00:00:00:00:00:00 from LAN
add rule arp arp_table input arp saddr ip $network_addr_4 arp daddr ether 00:00:00:00:00:00 accept

# Why output to broadcast never hits?
# This rule should handle output toward ff:ff:ff:ff:ff:ff to LAN
add rule arp arp_table output arp daddr ether $broadcast_ether log prefix "ACCEPT output broadcast: " accept

# Why output to 00:00:00:00:00:00 hits instead?
# This rule handles output toward 00:00:00:00:00:00 to LAN
add rule arp arp_table output arp saddr ether $physical_ether arp daddr ether 00:00:00:00:00:00 accept
There are several questions here, the main one being that ARP broadcast traffic ff:ff:ff:ff:ff:ff is nonexistent, that's why I added log statement to hopefully catch such traffic but it never appears, for both input and output traffic. What happens instead is I see a lot of intput/output directed toward 00:00:00:00:00:00 address, which suggests that 00:00:00:00:00:00 is broadcast address somehow. So the main question is why don't I see ARP traffic directed toward broadcast address and why is 00:00:00:00:00:00 address used instead? 2nd question is, what is 00:00:00:00:00:00 address? why it is needed and what does it mean? If I block traffic to/from 00:00:00:00:00:00 (ex. by removing those rules) then networking will stop to function due to a such ARP packets being dropped.
Asked by metablaster (776 rep)
Sep 17, 2024, 09:33 PM
Last activity: Sep 21, 2024, 04:34 PM