<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body dir="ltr" bgcolor="#ffffff" text="#000000">
<p style="margin-bottom: 0cm; margin-top: 0pt;">Oleg Goldshmidt wrote:<br>
</p>
<blockquote cite="mid:m3prgk16q7.fsf@goldshmidt.org" type="cite">
<pre wrap="">Shachar Shemesh <a class="moz-txt-link-rfc2396E" href="mailto:shachar@shemesh.biz"><shachar@shemesh.biz></a> writes:
</pre>
<blockquote type="cite">
<pre wrap=""> Unless VM0 sends an ARP inquiring about the destination IP,
This ARP is sent to a physical NIC.
</pre>
</blockquote>
<pre wrap=""><!---->
Actually, no. It is sent by the VM's virtual NIC (the VM does not know
anything else), and the "switch" in the hypervisor forwards it, among
other things, to the virtual NIC of the other VM, that has its own MAC
address, etc.
I suppose it may depend on the configuration - I am not performing any
experiments.
</pre>
<blockquote type="cite">
<pre wrap="">Unless it is layer 3 aware, there is no reason for it to know that
the ARP received through a physical Ethernet device originated in
our machine.
</pre>
</blockquote>
<pre wrap=""><!---->
But it isn't received on the physical interface - see above.
</pre>
<blockquote type="cite">
<pre wrap="">Who gave the VM</pre>
</blockquote>
</blockquote>
By "VM" I meant the virtual machine program. What you refer to as
"hypervisor". My mistake. From now on I'm using your (less confusing)
terminology.<br>
<br>
When I bind a VM NIC to a physical NIC, especially if I do it for two
different VMs and NICs (one NIC per VM), then the hypervisor has no
right to assume the NICs are layer 2 connected. Any other functionality
is a bug, and no two ways of looking at it. The network setup will
simply misbehave if this is the case.<br>
<blockquote cite="mid:m3prgk16q7.fsf@goldshmidt.org" type="cite"><br>
<pre wrap="">
It sends an Ethernet frame out of its
virtual NIC (the only one it knows of), and as soon as this is done
the VM considers the frame to be out in the "network", even though it
may still be inside the physical box.</pre>
</blockquote>
So far, so good.<br>
<blockquote cite="mid:m3prgk16q7.fsf@goldshmidt.org" type="cite">
<pre wrap=""> The hypervisor, in turn,
contains a virtual switch, that has virtual ports virtually connected
to the VM's virtual NICs,</pre>
</blockquote>
No no no no no!<br>
<br>
The hypervisor is well within its right to contain a virtual switch
that connects all of the VM NICs *that connect to the same physical
NIC*. It is perfectly ok for it to forward that packet to any other VMs
that connect to the same physical NIC, except in our case there are
none. If it forwards this packet to VMs that do not connect to the same
physical NIC, it has just connected two networks that were otherwise
not connected. If VMWare does that, it is buggy (but I doubt it does).<br>
<blockquote cite="mid:m3prgk16q7.fsf@goldshmidt.org" type="cite">
<pre wrap="">
At least this is what happens in today's VMware. Again, possibly
modulo configurations that I am not checking.</pre>
</blockquote>
Such as the configuration I'm suggesting?<br>
<blockquote cite="mid:m3prgk16q7.fsf@goldshmidt.org" type="cite">
<pre wrap=""> The motivation behind it
is exactly the above: not to send frames out to the physical network
if it can be avoided.</pre>
</blockquote>
The behavior you are suggesting is akin to a hardware switch forwarding
packets between two VLANS "to save on routing". A layer 2 switch is
simply not allowed to do that.<br>
<blockquote cite="mid:m3prgk16q7.fsf@goldshmidt.org" type="cite">
<pre wrap="">
Xen/KVM/others may be different (I have not checked lately if they
include virtual switches by default).
</pre>
</blockquote>
Of course they do (well, Xen does, at least). There is no other way to
function (a physical NIC does not "receive" its own outgoing packets
unless it's in promiscuous mode, possibly not even then). Again, this
has nothing to do with the scenario I'm describing.<br>
<br>
Shachar<br>
<br>
<pre class="moz-signature" cols="72">--
Shachar Shemesh
Lingnu Open Source Consulting Ltd.
<a class="moz-txt-link-freetext" href="http://www.lingnu.com">http://www.lingnu.com</a>
</pre>
</body>
</html>