When GRE Carries the LAN

The GRETAP findings change the open-tunnelling-host question from “which IP packet can cross?” to “which local Ethernet behavior can an untrusted sender trigger?” This section focuses on the bridge between a public interface and a private LAN, then uses representative MAC, ARP, DHCP, DNS, and loop effects to show what that bridge exposes. The practical judgment is to distinguish a demonstrated Layer 2 path from the stronger claim that every responding host permits every LAN attack.

GRETAP is not simply GRE with a different name. It is the Layer 2 form of GRE used in the paper to carry Ethernet frames. That payload can include traffic whose meaning depends on a local broadcast domain rather than on a single routed destination. Once an open GRETAP endpoint is connected to a private bridge, the remote sender is no longer asking only for a route toward an IP service. They may be supplying frames to the LAN’s local control plane.

The bridge changes what crosses the boundary

The topology in the authors’ experiments has four functional parts. A global interface receives traffic from the Internet. An open GRETAP interface removes the outer IP and GRE headers and exposes an Ethernet frame. A bridge connects that tunnel-side interface to a private-facing interface. The private-facing interface leads to the LAN. Each part has a distinct responsibility, but the security consequence comes from their combination.

The global interface answers the outer delivery question: has a packet reached the host that can process it? GRETAP answers the encapsulation question: can the host recover the Ethernet frame inside? The bridge answers a local delivery question: which attached interface or interfaces should receive that frame? The private interface then makes the bridge’s decision visible on the LAN. If the tunnel endpoint accepts a frame from an arbitrary remote source, every later component is being asked to process an object that did not arrive through the LAN’s ordinary admission path.

That path is more permissive in some ways than Layer 3 routing. An IP router normally uses the destination address to select a next hop. An Ethernet bridge also handles hardware addresses and broadcast destinations. A broadcast frame is deliberately addressed so that multiple devices on the local segment may inspect it. Local protocols use this behavior for discovery, address resolution, configuration, and announcements. The bridge does not need to know whether the frame came from a trusted cable, a legitimate tunnel peer, or an arbitrary Internet sender; it forwards according to its local rules.

This is the architectural escalation. An open Layer 3 tunnel can release an inner IP packet into routing or NAT processing. An open GRETAP endpoint can release an Ethernet frame into a private segment where several hosts and control protocols may respond. The endpoint has acquired an almost adjacent position. It can influence the network not only by selecting a destination but also by participating in the mechanisms that let devices discover one another and configure themselves.