@tjkreidl said:
@john.c Interesting information about the strong v. weak host model.
Active-active and LACP bonds will split the network traffic between the NICs, while an active-passive bond only uses the primary. WHat type of bonds do you have set up?
@tjkreidl I am actually running a balance-alb (Mode 6) bond because the upstream router has limited port capacity and does not support LACP.
This detail is the smoking gun for why the weak host model is causing this.
balance-alb achieves outbound and inbound load balancing entirely through Dom0-level manipulation without switch assistance:
Inbound Load Balancing via ARP Tricks: When an external device sends an ARP request for Dom0's IP, the bonding driver intercepts the reply and replaces the source MAC address with the hardware MAC of one of the specific slave NICs. It essentially tells different peers to use different physical paths to reach the same IP.
Outbound Load Balancing via Capability: The bonding driver intercepts outbound packets and dynamically assigns them to different slave NICs based on current interface load.
The Weak Host Collision:
Because balance-alb is constantly rewriting ARP tables and distributing packets across physical links at Layer 2, it relies on a perfectly deterministic Layer 3 network stack.
However, because Dom0 defaults to a weak host model, the kernel treats the IP addresses as globally bound to the whole host. Under heavy load or during a path change, the kernel's Layer 3 routing engine completely bypasses the bonding driver's intended pathing logic. It evaluates the destination, spots what it thinks is a "cheaper" path via the main routing metrics, and forces the packet out of a completely separate infrastructure interface (like Management or Storage) instead of keeping it within the balance-alb bond.
OpenMetrics packet-flow telemetry caught this exact moment: the kernel handed the packet to the wrong interface, causing the packet to miss the bond entirely and exit on a port where the destination was unreachable. This immediately broke the HA heartbeat loop and triggered the reboot.
