In this lesson, you will learn how to maintain network reachability for ephemeral containers by leveraging ARP Proxy and Gratuitous ARP to manage dynamic address resolution.
The Problem of Dynamic IPs
In highly dynamic container environments, IP addresses are often reassigned or shifted between namespaces. When a container migrates or restarts, traditional ARP caches on the host or physical switch may still point to stale hardware addresses (MAC addresses), leading to packet loss. We solve this using two key techniques: Proxy ARP and Gratuitous ARP.
Proxy ARP: The Helpful Intermediary
Proxy ARP allows a Linux device—typically the host bridge or a router—to answer ARP requests on behalf of another interface. If a container is isolated or residing in a different segment, the host can "proxy" the request by intercepting the ARP inquiry and replying with its own MAC address. This ensures the sender believes the destination is reachable, even if the destination's location is masked by network namespaces.
You can enable this on a specific interface via sysctl:
# Enable proxy ARP on the veth interface or bridge
sysctl -w net.ipv4.conf.veth0.proxy_arp=1
Gratuitous ARP: Announcing Presence
While Proxy ARP helps when you don't know the destination, Gratuitous ARP is about proactively announcing identity. A Gratuitous ARP is an ARP request or reply sent by a container when it joins a network or changes its IP. It essentially says: "I am here, and my IP is X, mapped to my MAC address Y."
By broadcasting this, the container forces every device on the segment to update their ARP tables immediately. This is vital when moving containers between nodes or re-attaching virtual interfaces. You can trigger this manually using arping to force an update across the bridge:
# Send a gratuitous ARP to notify the network of the container's IP
arping -U -I eth0 192.168.1.50
Combined, these mechanisms ensure that even as your container infrastructure scales and shifts dynamically, the underlying network hardware and host bridges maintain an accurate map of which IP belongs to which virtual interface.
Key Takeaway: Proxy ARP allows the host to act as a surrogate for unreachable targets, while Gratuitous ARP ensures the network proactively learns about IP shifts, eliminating stale cache entries in dynamic environments.