MACVLAN vs IPVLAN: Linux Network Drivers

In the Linux operating system, both macvlan and ipvlan are kernel drivers designed to bind multiple virtual network interfaces to a single physical interface, commonly used in containerized environments like Docker and Kubernetes. The primary distinction between the two lies in how they address and route network traffic: macvlan operates primarily at Layer 2 by assigning a unique MAC address to every virtual interface, whereas ipvlan operates at Layer 3 or Layer 2 by having all virtual interfaces share the physical parent interface's MAC address and differentiating traffic by IP address.

MAC Address Allocation and Layer Operations

The macvlan driver creates distinct virtual network endpoints that each possess their own unique MAC address. When connected to an external switch, each macvlan interface appears as an independent physical device plugged into that port.

In contrast, ipvlan shares the physical interface's MAC address across all created sub-interfaces. Because every virtual interface shares the same Layer 2 hardware address, packets sent to and from these interfaces rely on IP address matching to reach the correct destination.

Switch Limitations and Port Security

Because macvlan exposes multiple MAC addresses through a single physical interface, it can cause problems in enterprise environments where network switches enforce port security. Many network switches limit the number of MAC addresses allowed per port to prevent MAC flooding attacks; exceeding this limit can cause the port to be disabled. Additionally, hypervisors and public cloud environments (such as AWS and Azure) often drop packets with unknown MAC addresses, preventing macvlan from functioning properly without promiscuous mode.

ipvlan resolves this issue entirely. Because all traffic leaving the physical host uses a single, legitimate MAC address, upstream switches and cloud hypervisors do not detect multiple endpoints. This eliminates the risk of triggering MAC table exhaustion or port security violations.

Operational Modes

Both drivers provide distinct operational modes to control how virtual interfaces communicate:

• MACVLAN Modes:

  • Bridge: Endpoints on the same physical link can communicate directly with each other via an internal software bridge.
  • VEPA (Virtual Ethernet Port Aggregator): Endpoints cannot communicate directly; traffic must leave the physical interface, hit an external switch capable of hairpin routing, and return.
  • Private: Endpoints on the same physical interface cannot communicate with each other at all, even if an external switch supports reflection.
  • Passthru: Dedicated to a single container or namespace, granting full control of the physical interface directly to the sub-interface.

• IPVLAN Modes:

  • L2 (Layer 2): Behaves similarly to macvlan in bridge mode. The host acts as a bridge; ARP requests are handled normally, and broadcast traffic is distributed to all sub-interfaces belonging to that parent interface.
  • L3 (Layer 3): The host functions as an internal router rather than a bridge. Packets are routed between endpoints using Layer 3 IP lookups. In L3 mode, ARP and broadcast traffic are suppressed entirely, which drastically reduces network noise in large-scale deployments. However, it requires routing tables to be explicitly configured both on the host and the upstream network.

Wireless Network Compatibility

A notable technical limitation of macvlan is its incompatibility with standard wireless (Wi-Fi) interfaces. The IEEE 802.11 standard typically restricts client devices to a single MAC address per association. As a result, Wi-Fi frames carrying multiple MAC addresses generated by macvlan are rejected by the wireless access point.

Because ipvlan reuses the parent interface's existing MAC address, it functions seamlessly over Wi-Fi connections, making it the preferred choice for virtual networking on wireless-connected Linux systems.