How do processes decide which network interface/IP to use?

stockwellgreen · 11-05-2009, 06:04 PM

I apologise if this is a idiot question, I've searched at length but failed to find an answer!

My server has 1 NIC, configured with 5 public IPs. From analysing log files there seems little consistency with which running processes decide on which IP to use when making outgoing connections. For example, if I run a PHP script on an Apache instance listening on IP X, which sends out an email, I find that my mail server has initiated the SMTP connection on IP Y, or sometimes IP Z.

Are there any general rules for how processes decide which IPs they'll use to initiate socket connections? The configuration for most daemons seems to include the specification of which addresses to bind to, to listen for incoming connections, but not which addresses to utilise for unsolicited outgoing connections.

Please enlighten me.

kbp · 11-05-2009, 10:35 PM

If you check your routing table.. generally the first match is used to send off-network traffic

eg.

Code:

netstat -nr

I'd guess that your routing table will have a default gateway entry (flags = UG) that references a specific interface not a specific IP address, that's why you're seeing some randomness

cheers

stockwellgreen · 11-07-2009, 02:27 PM

Thanks for the reply, now I'm really confused!

This is my routing table:

Code:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
aa.bb.cc.128   0.0.0.0         255.255.255.248 U         0 0          0 eth0
0.0.0.0         aa.bb.cc.129   0.0.0.0         UG        0 0          0 eth0
0.0.0.0         aa.bb.cc.129   0.0.0.0         UG        0 0          0 eth0
0.0.0.0         aa.bb.cc.129   0.0.0.0         UG        0 0          0 eth0
0.0.0.0         aa.bb.cc.129   0.0.0.0         UG        0 0          0 eth0
0.0.0.0         aa.bb.cc.129   0.0.0.0         UG        0 0          0 eth0

And my interface, as shown by ifconfig -a, is:

Code:

eth0      Link encap:Ethernet  HWaddr 00:22:19:d6:66:d6
          inet addr:aa.bb.cc.130  Bcast:aa.bb.cc.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth0:1    Link encap:Ethernet  HWaddr 00:22:19:d6:66:d6
          inet addr:aa.bb.cc.131  Bcast:aa.bb.cc.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth0:2    Link encap:Ethernet  HWaddr 00:22:19:d6:66:d6
          inet addr:aa.bb.cc.132  Bcast:aa.bb.cc.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth0:3    Link encap:Ethernet  HWaddr 00:22:19:d6:66:d6
          inet addr:aa.bb.cc.133  Bcast:aa.bb.cc.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth0:4    Link encap:Ethernet  HWaddr 00:22:19:d6:66:d6
          inet addr:aa.bb.cc.134  Bcast:aa.bb.cc.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

My public IPs, as allocated by the ISP, are aa.bb.cc.130 - aa.bb.cc.134. I'm assuming aa.bb.cc.128 is the network address, and aa.bb.cc.129 is the ISPs router which my server connects to.

My mail server is listening on all of the public IPs, .130 - .134, yet mainly makes outgoing connections via the .134 IP. Apart from occasionally when it uses .132 or .133 (it may use the others too, I've not trawled through every single log!).

Presumably there's some underlying logic at work that I'm unaware of?

nimnull22 · 11-07-2009, 03:38 PM

May be that article can help a bit.
http://linux-ip.net/html/adv-multi-internet.html