Ytdyklly

$ ip -4 neigh show dev eno1

209.132.181.16  FAILED

152.19.134.142  FAILED

85.236.55.6  FAILED

152.19.134.198  FAILED

8.43.85.67  FAILED

140.211.169.206  FAILED

How could these weird ip neighbour (ARP) entries be appearing on my Ethernet interface?

eno1 is an Ethernet interface. It is not currently connected. Based on journalctl -b | grep eno1, I do not think I have connected it at all during this boot! I do not use a static IP. I have not changed my IP settings manually during this boot. The network settings are all managed by NetworkManager. I have connected only to my home networks, which use addresses in the private range 172.16.0.0 - 172.31.255.255 only.

For example on my current wireless connection, I see that my address is 172.16.8.139/24. That says the network prefix is 24 bits, and so ARP resolution should be limited to the range 172.16.8.0 - 172.16.8.255.

$ ip -4 addr show dev wlp2s0

4: wlp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000

    inet 172.16.8.139/24 brd 172.16.8.255 scope global dynamic noprefixroute wlp2s0

       valid_lft 39441sec preferred_lft 39441sec



$ ip -4 neigh show dev wlp2s0

172.16.8.1 lladdr 74:44:01:86:42:d6 REACHABLE

$ lsb_release -d

Description:    Fedora release 29 (Twenty Nine)

$ rpm -q NetworkManager dhcp-client

NetworkManager-1.12.6-5.fc29.x86_64

dhcp-client-4.3.6-28.fc29.x86_64

My router is OpenWRT 18.06.1, so the DHCP server is dnsmasq.

What are the "neighbours" called? - my first idea.

$ ip -r -4 neigh show dev eno1

proxy01.fedoraproject.org  FAILED

vm3.fedora.ibiblio.org  FAILED

6-55-236-85.rev.customer-net.de  FAILED

vm18.fedora.ibiblio.org  FAILED

proxy13-rdu02.fedoraproject.org  FAILED

proxy14.fedoraproject.org  FAILED

proxy09.fedoraproject.org  FAILED

It's trying to connect to a Fedora-specific service. I.e. the system uses some network service. Fedora is providing it. (And/or ibiblio.org are donating service to Fedora, using a specific host name, etc.) These hosts are most likely primarily providing some Web service (HTTP / HTTPS). "proxy" in a hostname tends to mean some form of Web proxy, and these can be used as a front end for various reasons e.g. caching or load balancing.

Why would I see such out-of-range ARP entries? - the biggest question.

I found the answer on StackOverflow: Why ARP requests a non-local address?

When one interface has no addresses/routes at all, but you explicitly tell Linux to transmit using it, Linux will assume your target address is on-link.[*]

$ sudo traceroute --udp -i eno1 8.8.8.8

traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets

^C

$ ip neigh show dev eno1 | grep 8.8.8.8

8.8.8.8  INCOMPLETE

I expect this is NetworkManager, because I don't have any other software which is likely to try to contact a Web service using a specific interface. (Note this operation requires privilege - I had to use sudo to run traceroute through a specific interface).

NetworkManager uses a web service to check internet connectivity, and to detect captive portals. This is mentioned in the CONNECTIVITY section of man NetworkManager.conf.

It looks like NetworkManager has been checking this interface, despite knowing there is no connection on it :-).

[*] This means the sender IP address in the ARP packet, is taken from a different interface :-). Or when I shut down my WiFi and libvirtd networks, it uses 0.0.0.0 :-). Tested using tcpdump and a second computer connected directly with an ethernet cable