--- title: How ARP Killed a Static Route « ipSpace.net blog | daily.dev description: A debugging story from netlab integration testing reveals how default Linux ARP settings can silently break static routes with multiple next hops. When a Linux... canonical: https://daily.dev/posts/how-arp-killed-a-static-route-ipspace-net-blog-enmsxw3cg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How ARP Killed a Static Route « ipSpace.net blog | daily.dev og:description: A debugging story from netlab integration testing reveals how default Linux ARP settings can silently break static routes with multiple next hops. When a Linux... og:url: https://daily.dev/posts/how-arp-killed-a-static-route-ipspace-net-blog-enmsxw3cg og:image: https://api.daily.dev/og/posts/ENMsXW3cg.png og:image:alt: How ARP Killed a Static Route « ipSpace.net blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How ARP Killed a Static Route « ipSpace.net blog **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 7 min read · 0 upvotes · 0 comments ## Summary A debugging story from netlab integration testing reveals how default Linux ARP settings can silently break static routes with multiple next hops. When a Linux probe node sends ARP requests using an IP address from a different interface (weak ES model behavior), Junos does not respond, leaving the ARP cache incomplete. The root cause: vJunos-switch only preemptively resolves ARP for one of two next hops in a multi-link static route, and Linux's default arp_announce setting causes it to source ARP requests from the wrong interface. The fix is tuning Linux sysctl parameters — specifically arp_announce=2, arp_ignore=1, and arp_notify=1 — to match the behavior of commercial network operating systems, which was subsequently added to netlab's Linux/FRR initialization scripts. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does Linux send ARP requests from the wrong interface IP address on a multi-homed host? Linux defaults to the 'weak ES model' (RFC 1122), where IP addresses belong to the whole host rather than specific interfaces. This means Linux may source ARP requests from any interface's IP, not necessarily the one on the same subnet as the target. Setting arp_announce=2 restricts ARP source addresses to the best local IP on the outgoing interface, matching the behavior of commercial network operating systems. _Engineers tuning Linux nodes as network probes or routers track sysctl gotchas like this on daily.dev._ ### What sysctl settings should I apply to make Linux ARP behavior match commercial network OS like Cumulus or Junos? Set net.ipv4.conf.default.arp_announce=2, net.ipv4.conf.default.arp_ignore=1, net.ipv4.conf.all.arp_notify=1, and net.ipv4.conf.default.arp_notify=1. These settings restrict ARP source address selection to the best local address on the outgoing interface and suppress gratuitous ARP quirks, matching the strong ES model used by most commercial network operating systems including Cumulus Linux. _Those hardening Linux routing nodes for production can find related networking edge cases discussed on daily.dev._ ## Similar posts on daily.dev - [When ARP Goes Wrong: Threat Hunting ARP Poisoning in Network Traffic](https://daily.dev/posts/when-arp-goes-wrong-threat-hunting-arp-poisoning-in-network-traffic-cr9xr7c4h) · InfoSec Write-ups · 1 upvotes · 0 comments - [The Never-Ending IPv6 Loopback Prefix Saga « ipSpace.net blog](https://daily.dev/posts/the-never-ending-ipv6-loopback-prefix-saga-ipspace-net-blog-4nlhgh10l) · ipSpace.net Blog · 0 upvotes · 0 comments - [Your router still depends on a 44-year-old protocol to locate every device on your network](https://daily.dev/posts/your-router-still-depends-on-a-44-year-old-protocol-to-locate-every-device-on-your-network-imka9mnej) · XDA Developers · 0 upvotes · 0 comments - [Dear Junos, Tunnels Are Not Virtual Links « ipSpace.net blog](https://daily.dev/posts/dear-junos-tunnels-are-not-virtual-links-ipspace-net-blog-1zdexbued) · ipSpace.net Blog · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/how-arp-killed-a-static-route-ipspace-net-blog-enmsxw3cg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How ARP Killed a Static Route « ipSpace.net blog","url":"https://daily.dev/posts/how-arp-killed-a-static-route-ipspace-net-blog-enmsxw3cg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-arp-killed-a-static-route-ipspace-net-blog-enmsxw3cg"},"datePublished":"2026-08-11T08:52:27.927Z","dateModified":"2026-08-11T09:42:50.440Z","description":"A debugging story from netlab integration testing reveals how default Linux ARP settings can silently break static routes with multiple next hops. When a Linux...","image":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","thumbnailUrl":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-arp-killed-a-static-route-ipspace-net-blog-enmsxw3cg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"How ARP Killed a Static Route « ipSpace.net blog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-arp-killed-a-static-route-ipspace-net-blog-enmsxw3cg#faq","mainEntity":[{"@type":"Question","name":"Why does Linux send ARP requests from the wrong interface IP address on a multi-homed host?","acceptedAnswer":{"@type":"Answer","text":"Linux defaults to the 'weak ES model' (RFC 1122), where IP addresses belong to the whole host rather than specific interfaces. This means Linux may source ARP requests from any interface's IP, not necessarily the one on the same subnet as the target. Setting arp_announce=2 restricts ARP source addresses to the best local IP on the outgoing interface, matching the behavior of commercial network operating systems. Engineers tuning Linux nodes as network probes or routers track sysctl gotchas like this on daily.dev."}},{"@type":"Question","name":"What sysctl settings should I apply to make Linux ARP behavior match commercial network OS like Cumulus or Junos?","acceptedAnswer":{"@type":"Answer","text":"Set net.ipv4.conf.default.arp_announce=2, net.ipv4.conf.default.arp_ignore=1, net.ipv4.conf.all.arp_notify=1, and net.ipv4.conf.default.arp_notify=1. These settings restrict ARP source address selection to the best local address on the outgoing interface and suppress gratuitous ARP quirks, matching the strong ES model used by most commercial network operating systems including Cumulus Linux. Those hardening Linux routing nodes for production can find related networking edge cases discussed on daily.dev."}}]} ```