Docs

Elastic Compute Service

Kernel fine-tuning

Modifying arp_announce and arp_ignore parameters in Linux operating system

By modifying the arp_announce and arp_ignore parameters, you can control the kernel policies for sending and responding to ARP requests, optimize network communication, and reduce the likelihood of encountering ARP spoofing.

warning

Except in specific complex network scenarios, especially those where ARP anomalies are caused by multiple network interfaces in the same CIDR block, you do not need to configure the arp_announce and arp_ignore parameters.

Terms

About ARP

Address Resolution Protocol (ARP) is a protocol used to resolve a network-layer (IP layer) IP address to a data link layer physical (MAC) address. In a TCP/IP network, every device has a unique IP address to identify its location on the network, while a MAC address is used to identify the network interface of a device. The ARP protocol enables computers to determine the MAC address of the destination device prior to sending data. When sending an IP packet, if a computer does not know the MAC address corresponding to the IP address of the destination device, it will obtain it by broadcasting an ARP request packet.

About the arp_announce parameter

The arp_announce parameter is a network parameter in Linux systems, primarily used to control the policy for selecting the source IP address of an ARP request packet. Valid values:

0: The kernel uses any available local IP address as the source IP address of the ARP request packet.

1: The kernel tries to avoid using an IP address that is not in the subnet of the network interface sending the request packet as the source IP address of the ARP request packet. If no suitable IP address is available, the ARP request packet is sent according to the rule specified by arp_announce=2.

2: The kernel prefers a local IP address in the same subnet as the destination IP address as the source IP address of the ARP request packet. If no suitable IP address is available, the kernel uses an IP address from another network interface capable of receiving ARP responses.

About the arp_ignore parameter

The arp_ignore parameter is a network parameter in Linux systems, primarily used to control the policy for how a network interface responds to an ARP request with a destination IP address matching the local IP address. Valid values:

0: When the destination IP address is the IP address configured on any network interface of the local machine, the network interface responds to the ARP request.

1: When the destination IP address is the IP address of the network interface, the network interface can respond to the ARP request.

2: When the destination IP address is the IP address of the network interface and both the source and destination IP addresses of the ARP request are in the same subnet, the network interface can respond to the ARP request.

3: If the local IP address corresponding to the destination IP address has a host scope, the network interface does not respond to the ARP request. If the scope is global or link, the network interface responds to the ARP request.

4 -7: Parameter values reserved by the system and not in use.

8: The network interface does not respond to any ARP requests.

Applicable scenario

Prevent ARP spoofing

When you set the arp_announce parameter to 0, the source IP address in the sent ARP packet is used as the source IP address of the IP data packet. Attackers can forge ARP packets to claim they are the intended device for the ARP request or response, causing ARP spoofing and resulting in a man-in-the-middle attack. In this case, you can modify the arp_announce parameter to ensure that the source of ARP requests sent by the server is clear and not easily exploited by attackers. At the same time, you can also modify the value of the arp_ignore parameter to restrict how the server responds to ARP requests, thereby reducing the likelihood of successful ARP spoofing.

Use the parameters in LVS-DR mode

Linux Virtual Server - Direct Routing (LVS - DR) mode is an IP layer-based load balancing technology. In this mode, each physical server node associates the virtual service IP address with its loopback network interface.

When a network interface sends an ARP request, if the source IP address in the ARP request packet is not the IP address of the network interface itself, other nodes that receive this request may record incorrect IP address and MAC address mappings in their ARP tables. This can lead to unexpected network issues and poses security risks. In such cases, you need to set the arp_announce parameter of the server to 2.

When ARP requests for the virtual service IP address are broadcast to each real server node, if the real servers respond to these requests arbitrarily, it may cause network traffic confusion. This could further result in traffic being routed to a single node continuously, rendering the load balancing capability ineffective. In such cases, you need to set the arp_ignore parameter of the server to 1.

Procedure

The arp_announce and arp_ignore parameters can be configured either globally (for all interfaces) or on a per-network interface basis.

warning

The actual effective value for each network interface is the maximum of the global (all) configuration and the configuration specific to that interface. For example: The global arp_announce parameter is set to 1, and the arp_announce parameter for the eth0 network interface is set to 2. In such cases, the actual effective value of the arp_announce parameter on the eth0 network interface is 2.

Configure global parameters

Global parameters configured using this method apply the same ARP policy to all network interfaces, facilitating batch management.

Configuration by using the proc interface

Configuration by using the arp.conf file

You can use this method to temporarily modify the parameter values while the operating system is running. Each time the instance restarts, you need to configure the parameters again.

Execute the following command to view the values of the global arp_announce and arp_ignore parameters.

cat /proc/sys/net/ipv4/conf/all/arp_announce
cat /proc/sys/net/ipv4/conf/all/arp_ignore

Sample output:

Execute the following command to configure the values of the global arp_announce and arp_ignore parameters.

echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore

tip

Replace 1 and 2 with the actual values required for your business. For more information, see About the arp_announce parameter and About the arp_ignore parameter.

Configure parameters for a specific network interface

This method allows you to specify parameter values for a specific network interface without impacting the ARP request transmission and response policies of other network interfaces.

Configuration by using the proc interface

Configuration by using the arp.conf file

You can use this method to temporarily modify the parameter values while the operating system is running. Each time the instance restarts, you need to configure the parameters again.

Execute the following command to view the parameter values of the eth0 network interface.

cat /proc/sys/net/ipv4/conf/eth0/arp_announce
cat /proc/sys/net/ipv4/conf/eth0/arp_ignore

tip

Replace eth0 with the actual name of the network interface.

Sample output:

Execute the following command to configure the values of the arp_announce and arp_ignore parameters.

echo 2 > /proc/sys/net/ipv4/conf/eth0/arp_announce
echo 1 > /proc/sys/net/ipv4/conf/eth0/arp_ignore

tip

Replace 1 and 2 with the actual values required for your business. For more information, see About the arp_announce parameter and About the arp_ignore parameter.

Replace eth0 with the actual name of the network interface.

Last updated: 2026.06.18 17:49:52