Why should the listening interface have a “/32” bit net mask in Invisible Mode?
With Linux, either interface is allowed to respond to ARP broadcasts – whether the IP address in the request is bound to that interface or another interface on the same machine. What can happen in this case is that the wrong interface may respond to various ARP requests, telling the machine who is asking for it to connect to the wrong interface. That in and of itself is not necessarily a problem, as internally the Linux kernel will generally route the packet to the correct interface. However, many managed switches will detect this type of ‘flopping’ back and forth between two physical ports on the switch – where sometimes the IP address is shown on one physical port, and other times, it is shown on a different physical interface – and will actually disable the physical ports that this machine is connected to. The condition above is often referred to as “ARP-flux”. By assigning a /32 subnet mask, that LAN1 interface will no longer have a routable IP, and will not be able to respond to a
