What happens to local LAN traffic on linux to non-loopback addresses?

Question

One thing I've never quite understood on Linux is what happens to local traffic that isn't directed at loopback.

For example, given the following network setup:

[root@pe-323-master ~]# ifconfig
eth0      Link encap:Ethernet  HWaddr 00:0C:29:2B:59:85
          inet addr:172.16.90.133  Bcast:172.16.90.255  Mask:255.255.255.0
          inet6 addr: fe80::20c:29ff:fe2b:5985/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1881 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1205 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:234047 (228.5 KiB)  TX bytes:134389 (131.2 KiB)

eth1      Link encap:Ethernet  HWaddr 00:0C:29:2B:59:8F
          inet addr:10.20.2.2  Bcast:10.20.2.255  Mask:255.255.255.0
          inet6 addr: fe80::20c:29ff:fe2b:598f/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:77 errors:0 dropped:0 overruns:0 frame:0
          TX packets:18 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:14880 (14.5 KiB)  TX bytes:1188 (1.1 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:13585 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13585 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:6501824 (6.2 MiB)  TX bytes:6501824 (6.2 MiB)

what actually happens when I ping a local non-loopback address?

[root@pe-323-master ~]# ping -c 1 172.16.90.133
PING 172.16.90.133 (172.16.90.133) 56(84) bytes of data.
64 bytes from 172.16.90.133: icmp_seq=1 ttl=64 time=0.011 ms

--- 172.16.90.133 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.011/0.011/0.011/0.000 ms

Does that traffic go out over the wire and come back, or is routed internally?

Traffic to local but non-loopback addresses is not sent to the network. What i'm not sure is that if the device is down or with cable disconnected it may stop working (and it might vary among different systems) — LatinSuD, Jun 30 '14 at 18:27
A related question is https://unix.stackexchange.com/q/347825/5132 . — JdeBP, Mar 23 '19 at 11:26

score 2 · Answer 1 · edited Apr 17 '19 at 07:52

Well because it was simple enough--I did an experiment on my own system.

Terminal 1

$ uname -a
Linux my-pc 3.15.1-1-ARCH #1 SMP PREEMPT Tue Jun 17 09:32:20 CEST 2014 x86_64 GNU/Linux

$ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.2  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6 fe80::21f:bcff:fe09:7b0a  prefixlen 64  scopeid 0x20<link>
        ether 66:60:13:37:06:66  txqueuelen 1000  (Ethernet)
        RX packets 451273  bytes 458871230 (437.6 MiB)
        RX errors 0  dropped 12  overruns 0  frame 0
        TX packets 305732  bytes 32068185 (30.5 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 0  (Local Loopback)
        RX packets 13166  bytes 667544 (651.8 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 13166  bytes 667544 (651.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


$ ping 192.168.1.2
PING 192.168.1.2 (192.168.1.2) 56(84) bytes of data.
64 bytes from 192.168.1.2: icmp_seq=1 ttl=64 time=0.048 ms
^C
--- 192.168.1.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.048/0.048/0.048/0.000 ms

Terminal 2

$ sudo tcpdump -i lo 'icmp and src 192.168.1.2'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 65535 bytes
21:27:17.944958 IP my-pc.home > my-pc.home: ICMP echo request, id 32419, seq 1, length 64
21:27:17.944975 IP my-pc.home > my-pc.home: ICMP echo reply, id 32419, seq 1, length 64

Terminal 3

$ sudo tcpdump -i eth0 'icmp and src 192.168.1.2'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

The results.. At least on my computer, the ping goes to lo never leaving my system.

Another way is to use traceroute.

$ sudo traceroute 192.168.1.2
traceroute to 192.168.1.2 (192.168.1.2), 30 hops max, 60 byte packets
 1  my-pc.home (192.168.1.2)  0.048 ms  0.014 ms  0.022 ms

score 1 · Answer 2 · answered Jun 30 '14 at 19:03

You can do a tcpdump on the loopback interface while doing the ping to the machine's IP address. This will show you what is happening.

Really, the traffic is never leaving the machine. If it did, it would not get it back. A switch or router won't forward traffic back to the interface it came from.

score 0 · Answer 3 · answered Jun 30 '14 at 23:46

Linux (and I think most other unix variants, but I'm not sure) routes locally-bound traffic locally, where:

by “locally-bound”, I mean traffic emitted by the system and whose destination is an IP address associated with one of the system's network interfaces;
by “routes locally”, I mean that the traffic is not sent to the network interface driver, but directly moved from the outgoing queue to the incoming queue.

Locally-bound packets do go through the netfilter (iptables) chains as if they weren't locally-bound — they aren't rerouted to 127.0.0.1 or to the lo interface. I don't know how they impact packet scheduling.

What happens to local LAN traffic on linux to non-loopback addresses?

3 Answers3

Linked