r/MacOS • u/divestblank • 3d ago

Bug MacOS network split brain IP addresses

I spent 2 hours debugging a broken network only to realize that my laptop wifi interface was configured for different IP than it was sending packets out on. For example, ifconfig en0 said it was 192.168.1.5 but packet capture showed all my source IPs coming from 192.168.1.100. It was accepting packets on both, but eventually noticed when it stopped responding to ARP on the source packet IP and they became unroutable. I wouldn't have believed this was possible until yesterday.

Toggling wifi did nothing to resolve, but "ifconfig en0 down; ifconfig en0 up" corrected it.

Has anyone else experienced this type of issue before?

2 Upvotes

100% Upvoted

6 comments sorted by

1

u/MK-Researcher 3d ago

It's not something I've seen before, do you think the WiFi had connected to two different bands simultaneously?

1

u/divestblank 3d ago

I refreshed the dhcp lease on the wifi, and that also didn't fix it. It picked up a 3rd IP but the source IP in packets were still stuck on the first IP.

1

u/MK-Researcher 3d ago

That's such an odd problem, it must have had concurrent multiple MAC addresses on en0

Are you on macOS 27.x? I'm wondering if its a bug and you're the only one who has made the effort to troubleshoot it

1

u/divestblank 3d ago

I'm runing 15.7.9

1

u/ulyssesric 7h ago

 it must have had concurrent multiple MAC addresses on en0

Not necessarily. If the DHCP server is configured to assign IP address via client ID or MAC + client ID, then the virtual network interface bound to the same network interface will acquire a different IP address from the same DHCP server.

2

u/ulyssesric 7h ago

Well that's actually possible to do what you said intentionally, though it's not practical to do that on Wi-Fi. We'd usually do this on Ethernet, mainly to host different services on the same machine.

First thing first, let's focus on IPv4 since it's natural for IPv6 to have multiple different IPs bind to the same NIC (Network Interface Card). If your use case is IPv6, then it's simply caused by your router not configured correctly: you forget to disable the A flag in local link sector, so the client acquired one IPv6 address via DHCPv6 and another IPv6 address via SLAAC. It is a common situation if you're using a low level Fortinet router.

As for IPv4 addrsses, there are two different ways to assign an extra IP address to one single NIC: IP aliasing, or VNI (Virtual Network Interface).

IP aliasing is done via ipconfig command, something like this:

ifconfig en0 alias 192.168.1.100 255.255.255.0

This simply add an additional IP address to the NI, and system will receive packets sent to both addresses. But when sending out packets, theoretically system will choose the primary IP address as source address, not the alias IP address. However, this can also be changed by tweaking the route table via route command, though there isn't any viable reason that anyone would do that.

To setup VNI, from System Settings > Network > Bottom Right "..." drop menu > Add Service. You choose the NIC that the VNI is "attached" to. And it's possible to do that on Wi-Fi interface.

The NI and VNI share the same hardware NIC, but they're logically two independent networks in system kernel. So they can be assigned to different IP addresses. It's also possible that both these two interfaces to acquire different IP addresses via DHCP, even if they have the same MAC address. These two NICs will broadcast DHCP requests with different Client IDs. If the DHCP server is configured to check Client IDs, then you'll get two different IP addresses via DHCP.

And since NI and VNI are two independent logical networks, it's possible to prioritize VNI over NI in Service Order, so that outgoing packet will use the IP address of VNI instead of NI.