arplookup x.x.x.x failed: host is not on local network

[Chuck Swiger]

David DeSimone wrote:
[ ... ]
> Again, I did see these messages in my environment, but in my case, the
> error was correct:  The IP *was not* on the local network.  The reason
> being that we had multiple subnets configured on the same broadcast
> domain, so the BSD box could indeed hear ARP for subnets it did not know
> about.  I don't know why the box feels moved to complain about this,
> however.  I would think it should not care.

It's good practice for machines intended to be on different subnets to be in 
different collision domains.  Seeing traffic to or from the wrong network 
should be considered a potential "red flag", warning that there might be a 
network misconfiguration that could compromise security.

In particular, if you want to securely host a bunch of client machines, 
setting them up on individual /30 subnets using a multiport firewall or a BSD 
box with a couple of 4-port NIC cards, rather than a switch, is a good idea. 
While this situation is something which is supposedly well-suited for VLANs, 
in practice most switches cannot be relied upon to actually prevent traffic 
from leaking outside of the specified VLAN.

This is more common for ARP traffic, which is sent to the all-ones MAC and may 
well get forwarded to all ports regardless of VLAN tagging, particularly if 
the switch is under load and has switched to some kind of "fast forwarding" 
mode or if it tends to consider all ports trunk ports by default or via 
dubious autolearning algorithms....

Regards,
-- 
-Chuck