Chip 1998 September/CHIP Eylül 1998.iso/Slackwar/docs/mini/Proxy-ARP

Text File | 1995-03-10 | 13.2 KB | 320 lines

               A small treatise on the use of ProxyARP
                 by Al Longyear <[e-mail]>
                           December 5, 1994

I. Introduction

This document is written to help those who are considering using the
proxy ARP (Address Resolution Protocol) logic within Linux in the aid
of PPP and SLIP server devices. Proxy ARP is also called 'gracious
ARP' in some sources of documentation. There have been numerous
requests for the use of proxy ARP. When it is not able to be used,
some people deem this as a flaw in the software and wonder why it is
broken.

I hope that with the aid of this document, people will understand
more about proxy ARP as well as when it is and is not useful.

The use of proxy ARP is useful when you have a server. It will allow
the dynamic connection of remote systems without the need for the
update of the routing tables on other system but the one associated
as the 'server'.

The term 'server' is somewhat of a misnomer. TCP/IP is a peer-to-peer
networking environment. It does not have a client to server relation
as other systems do in that resources are offered or 'shared' on
servers while clients 'use' them. However, it is convenient to call the
'system which answers the telephone' a server; while the 'system
which dials the telephone to connect to the server' a client.

Linux's networking software directly supports proxy ARP. There is
no need for a special daemon process such as proxyarpd used in some
systems.

Both the PPP protocol support code, pppd, and at least one of the SLIP
support code, dip-uri, will support proxy ARP. In addition, the
networking program, arp, will manage and display the table.

To understand how Proxy ARP works and when it may be used, you need to
have a basic understanding of how networking is performed in general.
The next three sections of this document will describe in the
briefest of terms how TCP/IP networking is performed and how routing
works.



II. The Hardware side of Networking

All networking using ethernet or token ring is performed using a MAC
(Media Access Control) address. This is a hardware address associated
with a specific controller. Each MAC address is unique. They are
assigned by the manufacturer of the controller. While they may be
overridden in software, this is not the general rule.

IP addresses are translated to MAC addresses using a special table
within the networking software called the `ARP cache'. When the
networking software wishes to send an IP frame to the specified
address, it will consult this cache to determine the MAC address. If
the entry is not found in the cache, a special request is made of all
systems attached to the network to resolve the IP address to a MAC
address. This is called an ARP request.

The response to the ARP request is a reply with the MAC address. This
MAC address is then added to the cache so that the translation may be
performed subsequently without the aid of ARP.

It is this ARP request which is used by the proxy ARP logic to aid
in the support of remote connections.

There are rules by which the entries in the cache are removed. Those
rules are not germane to this document and are best left to a
technical description of ip networking.

(While token ring is under development, and is available on a test
basis, the common networking transport media for Linux is ethernet. I
will use the term 'ethernet' from now on. Similar facilities are
available for token ring, irrespective of token ring's source routing.)



III. Reason for the use of Proxy ARP

The purpose of proxy ARP is to allow the assignment of more than one
IP address to a single network adapter.

The manner in which it does this is to create an entry in the ARP
cache of Linux which associates the additional IP address with the
hardware address of the ethernet controller. This permits the Linux
system to respond to an ARP request to translate an IP address to a
hardware address.



IV. TCP/IP Routing

[A small preface is in order at this time. This describes the
'spanning-tree' routing. It does not describe 'source-routing' of IP
frames. The source routing performed by token ring is not IP source
routing but is performed at the MAC layer. The use of IP source
routing is discouraged. Token ring MAC source routing is a
requirement of that transport.]

To understand more about proxy ARP, you need to understand how IP
frames are routed on the network. I do not plan to go into great
detail. If you wish additional information, there are many books
available which will offer more in-depth information. (If you don't
wish the books, then look at the RFC documents.)

IP frames are routed at each stage of their passage through the
network. Each host, router, and gateway decides for itself and based
upon its own copy of the routing tables where the specific IP frame is
to be transmitted.

The routing is performed using the term which I will call an
'IP network'. Each network interface is assigned an unique IP network.
Each is given an IP address. Each is given a netmask. The 'IP network'
is simply the logical conjunction of the IP address with the netmask.
For example, the IP address of 10.124.35.40 and the netmask of
255.255.0.0 would have an 'IP network' of 10.124.0.0. While I am using
byte netmasks, the same logic would apply to the non-byte boundary
netmasks.

Linux associates the netmask with the route entry. When you add a
route into the system, you specify a IP address and the associated
destination device. If you don't specify a netmask, the netmask is
taken from the destination device's default netmask which is set when
the device is configured with ifconfig.

To better understand routing, consider the following configuration of
a sample system.

Destination     Netmask          Gateway       Flags    Device
10.124.0.0      255.255.0.0      0.0.0.0       U        eth0
10.125.0.0      255.255.0.0      0.0.0.0       U        eth1
10.126.0.0      255.255.0.0      10.125.31.1   UG       eth1
10.124.12.5     255.255.255.255  0.0.0.0       UH       ppp0
0.0.0.0         0.0.0.0          10.124.25.1   U        eth0

This is a system with three network devices. It has two ethernet
controllers and one PPP device. IP frames may come into this system
from any one of the three sources. In addition, frames are forwarded
through this system to any one of the three destination devices.

The default route is to the gateway device at 10.124.25.1 as
demonstrated by the last entry. To reach that gateway, the frame is
to be transmitted by the eth0 controller.

There is one PPP device connected. Its IP address is 10.124.12.5.

The eth0 device is on the IP network of 10.124.0.0 while the eth1
device is on the IP network 10.125.0.0.

In addition, there is a net route to the IP network 10.126.0.0
available at the gateway associated with 10.125.31.1.

To understand how routing is performed, consider an IP frame for the
destination of 10.125.45.1.

Linux will go through the route table and for each entry, take the
netmask, perform a logical conjunction (and) with the netmask and
then compare it to the entry's destination IP address. If the result
matches, the frame is sent to the device indicated.

The result is that the frame for the IP address of 10.125.45.1 will
be sent to the eth1 device.

Likewise a frame for the IP address of 10.124.12.5 will go to the
ppp0 device while the IP address of 10.124.12.6 will go to the eth0
device since the ppp0 device will only accept its one IP address of
10.124.12.5.

Frames for 10.126.31.4 are different. They have a 'gateway'
associated with them. They are found in the similar manner. However,
instead of just sending them to the eth1 device, they are sent to the
one system which is associated with the IP address of 10.125.31.1. It
is this IP address which is translated to a MAC address, rather than
the destination address, 10.126.31.4.

When they arrive at the 10.126.31.1 system, that system will forward
them on to the final destination of 10.126.31.4 by using its routing
table which may say to send it on its eth3 interface.

There are many error conditions which are caught by this form of
routing. I don't want to go into all of them, however, if for
example, 10.126.31.1 did not have a path to reach the .4 address,
then it would send back a ICMP (Internet Control Message Protocol)
frame to the original sender that it does not have a 'route to the
host' condition.



V. Routing with Proxy ARP

Finally, we are getting to the focus of this document now that all of
the foundation has been described.

Remember that Linux will put an entry into the ARP cache for the IP
address and the associated hardware MAC address when it is to do proxy
ARP. Remember that this cache is used to translate IP addresses to
MAC addresses.

When the remote connects at IP address 10.124.12.5, the Linux system
will add this IP address and the MAC address associated with the eth0
controller to the ARP cache.

When it receives a request to translate the IP address 10.124.12.5 to
a MAC address, it will send the entry from its tables to the
requester. The result is that frames to this IP address will be sent
to the server and the server may then forward them to the remote
system.

This is how proxy ARP works. The server is a proxy (an agent, an
inter-lopper, a 'front' person, etc.) for the remote IP address. It is
saying to the network that it can accept frames for the remote IP
address and deliver them by responding to the ARP requests.

So, for proxy ARP to work, the IP address of the remote (10.124.12.5
in my example) needs to be on one of the IP networks for a network
adapter.

There are two reasons for this requirement.

The first reason is that the MAC address of the controller is entered
into the ARP cache to be associated with the IP address. A MAC
address is required for the ARP assignment since the ARP cache is a
translation from IP addresses to MAC addresses.

The second reason is that all systems on the network do their own
routing. They know that to send a IP frame to the remote's IP address
that they must 'put it on the same wire' which is connected to the
server's network adapter.



VI. When Proxy ARP will not work

Consider what would happen if the remote's IP address was 10.200.3.1
rather than 10.124.12.5.

1. The remote systems would not know where to send this address.

They all know that to reach the IP network 10.124.0.0 that the frames
should go on the cable attached to eth0. However, there is no IP
network for 10.200.0.0. They would not know where to send frames to
this destination.

2. The server would not know what controller to use for the
   appropriate MAC address when it made the ARP entry.

This is the most common reason why proxy ARP will not work for people
who wish to use it. They have a different IP network associated with
the remote IP address than one of their own network interfaces.



VII. Problems with Proxy ARP and what must be avoided

1. Do not have more than one system respond to the proxy ARP entry for
   a specific IP address. In the case of BSD, this will may mean that
   since proxy ARP for a range of addresses, ensure that that the
   address ranges do not conflict. For a network based upon BSD networking,
   this means that you should dedicate the entire network to one server.

Again, BSD systems will bitterly complain if it receives more than one
reply for its ARP request.

2. Do not attempt to perform Proxy ARP for an address which is already
   present on the network.

This is a slight variation of the above problem. If you attempt to
perform proxy ARP for an IP address which is presently available on
the network, then two replies will be generated. This may mean that
you should not take IP addresses from one network and move them to a
remote connection which may cause the server to attempt to perform
Proxy ARP.



VII. What to do if you can't use Proxy ARP but want the same
functionality.

There are several choices available if you are unable to use proxy
ARP.

The easiest is to subnet the remote IP addresses so that all of the
remote addresses are on their own IP network. Then add a network route
on each of the routers (those devices which are indicated by the
'gateway' addresses of all of your hosts) so that the IP network is to
be sent to the server to which the remote IP addresses connect.

Alternately, you could use gated on the server and the routers.

Alternately, you could put a host route if you don't wish to subnet
the IP network. You would put entries in each of the routers for all
of the remote IP addresses.

You need to update only the gateways and routers. You do not need to
change all of the hosts in your network. The default routes which the
hosts use to send frames to routers will cause what is called a "ICMP
re-direct" frame to be sent to the host making the request. This will
automatically add a 'host' route to the appropriate server.



VIII. Conclusion

I hope that I have explained a little more about the proxy ARP and
how it works. Fortunately, if you use pppd or dip-uri, you do not
need to know how the mechanical steps in using it. It is
automatically performed for you by these pieces of software.

Proxy ARP is not for everyone. It is a workable solution in some
cases. Hopefully, you can determine for yourself whether this will
help you with your networking problems.

Additional information may be found in the book 'TCP/IP Illustrated,
volume 1' "The protocols" by W. Richard Stevens and published by
Addison Wessley.

Thank you.