Ytdyklly

When I run cat /proc/net/arp I see two entries* bound to :

IP address       HW type     Flags       HW address            Mask     Device

35.224.99.156    0x1         0x0         00:00:00:00:00:00     *        docker0

35.222.85.5      0x1         0x0         00:00:00:00:00:00     *        docker0

Even after ip -s -s neigh flush all and arp -n these entries come back. What do the results above mean?

Why is the ARP binding the docker0 device to an IPs (35.224.99.156) and (35.222.85.5) with mac 00:00:00:00:00:00 which I do not recognise all though they are from Google Cloud/Google or spoofed to be as such.

Is this expected, a bug or corruption or something more sinister?

*detected originally using OSQuery

SELECT address, mac, COUNT(mac) AS mac_count

  FROM arp_cache GROUP BY mac

  HAVING count(mac) > 1;

docker network inspect bridge is

[

   {

       "Name": "bridge",

       "Id": "REDACTED",

       "Created": "2019-02-09T17:38:43.817882245Z",

       "Scope": "local",

       "Driver": "bridge",

       "EnableIPv6": false,

       "IPAM": {

           "Driver": "default",

           "Options": null,

           "Config": [

               {

                   "Subnet": "172.17.0.0/16",

                   "Gateway": "172.17.0.1"

               }

           ]

       },

       "Internal": false,

       "Attachable": false,

       "Ingress": false,

       "ConfigFrom": {

           "Network": ""

       },

       "ConfigOnly": false,

       "Containers": {},

       "Options": {

           "com.docker.network.bridge.default_bridge": "true",

           "com.docker.network.bridge.enable_icc": "true",

           "com.docker.network.bridge.enable_ip_masquerade": "true",

           "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",

           "com.docker.network.bridge.name": "docker0",

           "com.docker.network.driver.mtu": "1500"

       },

       "Labels": {}

   }

]

These are from connectivity-checks made by NetworkManager.

# nslookup connectivity-check.ubuntu.com

Server:         127.0.0.53

Address:        127.0.0.53#53



Non-authoritative answer:

Name:   connectivity-check.ubuntu.com

Address: 35.224.99.156

Name:   connectivity-check.ubuntu.com

Address: 35.222.85.5

There is a bug so the arp-request go out the wrong interfaces. See: https://bugzilla.redhat.com/show_bug.cgi?id=1634286

You can prevent this by removing the package network-manager-config-connectivity-ubuntu

apt purge network-manager-config-connectivity-ubuntu