BitByteIntegration Cloud-Native Networking Architecture Series Part 6 of 6 — Tracking a Packet Through MACVLAN & IPVLAN (Series Finale)
Home / Learning / Networking / MACVLAN & IPVLAN
📘 Cloud-Native Networking Architecture Series · Part 6 of 6 · Finale

Tracking a Packet Through MACVLAN & IPVLAN

⏱ 20 min read 🔗 Direct Attachment 📊 Intermediate

Understanding lightweight direct-attached networking in OpenShift Virtualization, and when to choose MACVLAN or IPVLAN over Linux Bridge, OVN, and SR-IOV.

Reading Time20 min
DifficultyIntermediate
AuthorKashif Ali
UpdatedJuly 2026
MACVLANIPVLANMultusKubeVirtLinux KernelOpenShift Virtualization
Prerequisites
Read: Part 1 — Linux Bridge Read: Part 5 — SR-IOV Basic Ethernet / MAC addressing concepts
Cloud-Native Networking Series
Part 1 — Linux Bridge
Part 2 — OVN-Kubernetes
Part 3 — Localnet
Part 4 — UDN & CUDN
Part 5 — SR-IOV
Part 6 — MACVLAN & IPVLAN FINALE
⚡ Quick Facts — Native Networking Without Special Hardware
Overlay❌ No
Linux Bridge❌ No
OVS❌ No
Hardware VF❌ No
Native Ethernet✔ Yes
Requires SR-IOV NIC❌ No
The Complete Series
PartNetwork TypePacket Leaves Node As
Part 1Linux BridgeNative Ethernet
Part 2OVN-KubernetesGeneve Encapsulated
Part 3LocalnetNative Ethernet
Part 4UDN / CUDNGeneve Encapsulated
Part 5SR-IOVNative Ethernet — hardware
Part 6MACVLAN / IPVLANNative Ethernet — kernel driver

Why This Matters

Why MACVLAN and IPVLAN Exist

By this point in the series, you know two very different answers to "how do I get a workload directly onto my network." Linux Bridge (Part 1) works, but it still builds a small internal topology — a TAP device, a bridge, a veth pair — before the frame ever reaches the NIC. SR-IOV (Part 5) removes all of that, but demands SR-IOV-capable hardware, IOMMU support, and a Virtual Function allocation strategy.

Sometimes neither answer fits. You don't need overlay isolation. You don't have specialized NICs. You just need a pod or VM to have its own address directly on the physical network, with the least possible machinery in between.

Linux Bridge (Part 1) VM Bridgetap · veth NIC MACVLAN / IPVLAN (this article) VM macvlan / ipvlankernel driver only NIC SR-IOV (Part 5) VM VFhardware slice NIC One fewer hop than Linux Bridge, no special hardware required unlike SR-IOV
Diagram 1 — Positioning MACVLAN/IPVLAN between Linux Bridge and SR-IOV

That's exactly the gap MACVLAN and IPVLAN fill: native Ethernet connectivity, with no bridge and no special hardware — just a kernel driver standing directly between the workload and the NIC.


Section 02

Meet MACVLAN

A MACVLAN interface creates another virtual network interface directly on top of a physical one — with its own, genuinely unique MAC address. No bridge sits between them. No OVS. No overlay.

Physical NIC (ens5f0)MAC: hardware macvlan AMAC: aa:bb:cc:...:01 macvlan BMAC: aa:bb:cc:...:02 VM 1192.168.1.10 VM 2192.168.1.11
Diagram 2 — MACVLAN Architecture: each VM gets its own MAC address directly on the physical NIC

To the physical switch, each MACVLAN interface looks exactly like a separate physical host plugged into the network — because as far as MAC learning is concerned, it is one.


Section 03

Meet IPVLAN

IPVLAN takes the opposite approach to addressing. Instead of giving every interface its own MAC, every IPVLAN interface shares the parent NIC's single MAC address — and instead uses IP addressing to tell traffic apart.

Physical NIC (ens5f0)one shared MAC ipvlan AIP: 10.0.0.10 ipvlan BIP: 10.0.0.11 VM 1shares PF MAC VM 2shares PF MAC Hardware only ever sees ONE MAC address on the wire
Diagram 3 — IPVLAN Architecture: all VMs share one MAC; the hardware only sees a single address on the wire
Architecture Note: This single design difference — one MAC vs. many — is the root cause of nearly every other distinction between MACVLAN and IPVLAN covered in this article.

Section 04 · The Heart of the Article

MACVLAN vs. IPVLAN

This is the comparison the entire article builds toward.

MACVLANMultiple MACs · L2 · Better isolation IPVLANOne MAC · L2/L3 · Better scalability
Diagram 4 — MACVLAN vs. IPVLAN, side by side
MACVLANIPVLAN
Multiple MAC addressesOne shared MAC
Switch learns every VM's MACSwitch learns only one MAC
Better isolation between VMsBetter scalability at large VM counts
L2L2 or L3
Normal broadcast behaviorReduced broadcast / CAM table pressure
Architecture Note: If your switch's CAM (MAC address) table is a scaling concern — common in dense VM environments — IPVLAN's single-MAC model is the direct answer. If VM-level isolation at Layer 2 matters more, MACVLAN's separate-MAC model gives each workload a genuinely distinct identity on the wire.

Section 05

Linux Kernel Architecture

Placed next to Linux Bridge, the simplification is immediately visible.

Linux Bridge Guest tap bridge macvlan Guest macvlan driver (bridge step doesn't exist) Same NIC hop below — one fewer kernel component above it
Diagram 5 — Linux Bridge vs. MACVLAN: the bridge step simply doesn't exist

Both paths terminate at the same physical NIC. The difference is entirely in what happens above it: Linux Bridge builds a small software switch inside the kernel; MACVLAN's driver just multiplexes frames to the correct virtual interface based on destination MAC, with no switching logic in between.


Section 06 · Signature

Packet Walk — MACVLAN

VM192.168.1.10macvlan ifaceMAC aa:...:01NIC driverhardware handoffPhysical NICens5f0Switchlearns new MAC
Diagram 6 — MACVLAN Packet Walk: 192.168.1.10 exits with its own dedicated MAC
1

VM generates the frame

The guest at 192.168.1.10 sends a frame from its virtual NIC, tagged with its own unique MAC address aa:bb:cc:...:01.

2

MACVLAN interface

The kernel's macvlan driver receives the frame on this VM's dedicated sub-interface — no bridge lookup occurs.

3

NIC driver handoff

The macvlan driver hands the frame directly to the physical NIC's driver for transmission.

4

Physical NIC (ens5f0)

The frame is transmitted exactly as-is — the physical NIC has no idea a macvlan driver was even involved.

5

Physical switch

The switch learns a brand-new MAC address on this port — from its perspective, a new device has appeared on the network.


Section 07

Packet Walk — IPVLAN

Same hardware, genuinely different addressing model.

VM10.0.0.10ipvlan ifaceshares PF MACNIC driveraddress-based demuxPhysical NICens5f0Switchsees same MAC
Diagram 7 — IPVLAN Packet Walk: 10.0.0.10 exits sharing the parent interface's MAC
1

VM generates the frame

The guest at 10.0.0.10 sends a frame — but its source MAC is the same MAC as the parent NIC and every other ipvlan sibling.

2

IPVLAN interface

The kernel's ipvlan driver demultiplexes traffic by IP address rather than MAC — it knows which VM sent what based on source address, not hardware identity.

3

NIC driver handoff

The frame passes to the physical NIC's driver exactly as with macvlan — no bridge, no switching logic.

4

Physical NIC (ens5f0)

Transmission proceeds using the single shared MAC address for every VM behind this interface.

5

Physical switch

The switch's MAC table gains nothing new — it already knows this MAC. Multiple VMs are invisible to it as distinct L2 identities.

Architecture Note: This is why IPVLAN scales better in dense environments — a switch with a finite CAM table can host far more VMs behind a handful of physical MACs than it could if every VM claimed its own entry.

Section 08 · Often Skipped

Linux Kernel Modes

Both drivers support multiple operating modes — a detail most articles skip entirely.

MACVLAN Modes BridgeVMs talk to each other Privatefully isolated peers VEPAreflective relay Passthru1 VF-like device IPVLAN Modes L2switch-like L3routed, no ARP L3SL3 + conntrack Bridge mode is the common default for VM workloads; Private mode is used when peer VMs on the same host must not see each other's traffic at all
Diagram 8 — Kernel Mode Comparison: MACVLAN (Bridge, Private, VEPA, Passthru) and IPVLAN (L2, L3, L3S)

MACVLAN modes: Bridge mode allows sibling interfaces to talk to each other directly; Private mode fully isolates them from one another; VEPA mode reflects all traffic through the upstream switch, even between siblings; Passthru mode dedicates the entire physical interface to a single macvlan endpoint.

IPVLAN modes: L2 mode behaves like a switch at Layer 2; L3 mode routes between endpoints without ARP, purely by IP; L3S adds connection tracking on top of L3 mode, which matters if you need stateful firewalling.


Section 09

OpenShift Integration

The same pattern from every earlier article in this series — a familiar shape by now.

NetworkAttachmentDefinitionadmin definesMultusCNI meta-pluginmacvlan/ipvlan CNIcreates interfaceVM / Podattaches
Diagram 9 — OpenShift Integration: NetworkAttachmentDefinition → Multus → macvlan/ipvlan CNI → VM

A NetworkAttachmentDefinition declares the interface type — macvlan or ipvlan — along with the parent physical interface and any addressing configuration. Multus reads it and invokes the appropriate CNI plugin at pod or VM creation time, which creates the actual kernel interface and attaches it.


Section 10 · Recurring Signature

Packet Leaves the Wire As...

The complete version of the series' running comparison — all six articles, one table.

NetworkWire Format
Linux BridgeNative Ethernet
OVNGeneve
LocalnetNative Ethernet
UDNGeneve
SR-IOVNative Ethernet
MACVLANNative Ethernet
IPVLANNative Ethernet

Section 11

Advantages

✅ MACVLAN
  • Native Ethernet — no overlay
  • No bridge, no OVS
  • Simple to configure and reason about
  • Good performance, close to bare-metal
✅ IPVLAN
  • Single MAC per parent interface
  • Scales better at high VM density
  • Reduced switch CAM table pressure
  • Cloud and hypervisor-provider friendly

Section 12

Limitations

⚖️ MACVLAN
  • Host cannot normally reach its own macvlan interfaces without extra configuration
  • Switch MAC table grows with every new interface
  • Port security policies on some switches may block unexpected new MACs
⚖️ IPVLAN
  • Shared-MAC model restricts certain MAC-dependent protocols
  • L3 mode changes routing behavior guests may not expect
  • Less workload-level isolation than MACVLAN provides

Section 13

Common Misconceptions

"MACVLAN is faster than SR-IOV." No. SR-IOV still holds the latency advantage — it bypasses the kernel entirely via hardware DMA. MACVLAN is fast because it's simple, not because it's hardware-accelerated.
"IPVLAN uses multiple MACs." No — that's MACVLAN. IPVLAN's entire design point is sharing one MAC across every child interface.
"MACVLAN replaces Linux Bridge." Not universally. Linux Bridge still wins when VMs need to communicate freely with each other and with the host on the same node — a scenario MACVLAN's host-isolation limitation makes awkward.
"IPVLAN is an overlay." No. There's no encapsulation, no tunnel, no Geneve header — it's native Ethernet with a different addressing strategy, not a virtual network layered on top of a physical one.

Section 14 · Series Culmination

Decision Matrix

Six articles, one lookup table.

RequirementBest Choice
General VM networkingLinux Bridge
Kubernetes-native SDNOVN-Kubernetes
Enterprise VLAN integrationLocalnet
Tenant isolationUDN / CUDN
Maximum performanceSR-IOV
Native Ethernet, no special hardwareMACVLAN
Large-scale L2 with many VMsIPVLAN

Section 15 · The Reference Chart

Complete Networking Comparison

Every network type covered in this series, side by side. Bookmark this table — it's the one you'll come back to.

FeatureBridgeOVNLocalnetUDNSR-IOVMACVLANIPVLAN
OverlayNoYesNoYesNoNoNo
Bridge / OVSBridgeOVSOVSOVSNoNoNo
Hardware VFNoNoNoNoYesNoNo
Native EthernetYesNoYesNoYesYesYes
PerformanceGoodGoodBetterGoodExcellentVery GoodVery Good
FlexibilityHighHighMediumHighLowerMediumMedium
Best UseGeneral VMsCloud-nativeVLAN integrationMulti-tenancyTelco / NFVLightweight native L2Large-scale L2/L3

Section 16

Key Takeaways


🎉 Congratulations
You've completed the Cloud-Native Networking Architecture series. Across six articles, you've followed packets through every major networking model available in OpenShift Virtualization and KubeVirt — from Linux kernel bridges and distributed SDN overlays to physical VLAN integration, multi-tenant topologies, hardware acceleration, and lightweight native networking.
Next Series
Cloud-Native Storage Architecture
We'll trace I/O through OpenShift Data Foundation, Ceph, KubeVirt volumes, and storage networking — with the same architecture-first, packet-by-packet approach that defined this series.