diff -ur v2.6.3/linux/Documentation/filesystems/proc.txt linux/Documentation/filesystems/proc.txt
--- v2.6.3/linux/Documentation/filesystems/proc.txt	2003-09-27 23:14:56.000000000 +0300
+++ linux/Documentation/filesystems/proc.txt	2004-02-19 00:15:10.718320864 +0200
@@ -1595,6 +1595,16 @@
 
 Determines whether to send ICMP redirects to other hosts.
 
+hidden
+------
+
+Hide  addresses attached  to this device  from other  devices.  Such addresses
+will  never be selected  by source address  autoselection mechanism, host does
+not  answer broadcast ARP requests for them,  does not announce them as source
+address  of ARP requests,  but they are  still reachable via  IP. This flag is
+activated  only if it is enabled both  in specific device section and in "all"
+section.
+
 Routing settings
 ----------------
 
diff -ur v2.6.3/linux/Documentation/networking/ip-sysctl.txt linux/Documentation/networking/ip-sysctl.txt
--- v2.6.3/linux/Documentation/networking/ip-sysctl.txt	2004-02-19 00:13:33.000000000 +0200
+++ linux/Documentation/networking/ip-sysctl.txt	2004-02-19 00:15:10.719320712 +0200
@@ -507,6 +507,14 @@
 Alpha 1/1024s. See the HZ define in /usr/include/asm/param.h for the exact
 value on your system. 
 
+hidden - BOOLEAN
+	Hide addresses attached to this device from other devices.
+	Such addresses will never be selected by source address autoselection
+	mechanism, host does not answer broadcast ARP requests for them,
+	does not announce them as source address of ARP requests, but they
+	are still reachable via IP. This flag is activated only if it is
+	enabled both in specific device section and in "all" section.
+
 Alexey Kuznetsov.
 kuznet@ms2.inr.ac.ru
 
diff -ur v2.6.3/linux/include/linux/inetdevice.h linux/include/linux/inetdevice.h
--- v2.6.3/linux/include/linux/inetdevice.h	2004-02-19 00:13:38.000000000 +0200
+++ linux/include/linux/inetdevice.h	2004-02-19 00:15:39.144999352 +0200
@@ -22,6 +22,7 @@
 	int	no_xfrm;
 	int	no_policy;
 	int	force_igmp_version;
+	int	hidden;
 	void	*sysctl;
 };
 
@@ -58,6 +59,7 @@
 
 #define IN_DEV_LOG_MARTIANS(in_dev)	(ipv4_devconf.log_martians || (in_dev)->cnf.log_martians)
 #define IN_DEV_PROXY_ARP(in_dev)	(ipv4_devconf.proxy_arp || (in_dev)->cnf.proxy_arp)
+#define IN_DEV_HIDDEN(in_dev)		((in_dev)->cnf.hidden && ipv4_devconf.hidden)
 #define IN_DEV_SHARED_MEDIA(in_dev)	(ipv4_devconf.shared_media || (in_dev)->cnf.shared_media)
 #define IN_DEV_TX_REDIRECTS(in_dev)	(ipv4_devconf.send_redirects || (in_dev)->cnf.send_redirects)
 #define IN_DEV_SEC_REDIRECTS(in_dev)	(ipv4_devconf.secure_redirects || (in_dev)->cnf.secure_redirects)
diff -ur v2.6.3/linux/include/linux/sysctl.h linux/include/linux/sysctl.h
--- v2.6.3/linux/include/linux/sysctl.h	2004-02-19 00:13:38.000000000 +0200
+++ linux/include/linux/sysctl.h	2004-02-19 00:16:13.732741216 +0200
@@ -362,6 +362,7 @@
 	NET_IPV4_CONF_NOXFRM=15,
 	NET_IPV4_CONF_NOPOLICY=16,
 	NET_IPV4_CONF_FORCE_IGMP_VERSION=17,
+	NET_IPV4_CONF_HIDDEN=18,
 };
 
 /* /proc/sys/net/ipv4/netfilter */
diff -ur v2.6.3/linux/net/ipv4/arp.c linux/net/ipv4/arp.c
--- v2.6.3/linux/net/ipv4/arp.c	2004-02-19 00:13:38.000000000 +0200
+++ linux/net/ipv4/arp.c	2004-02-19 00:16:51.013073744 +0200
@@ -71,6 +71,8 @@
  *					arp_xmit so intermediate drivers like
  *					bonding can change the skb before
  *					sending (e.g. insert 8021q tag).
+ *		Julian Anastasov:	"hidden" flag: hide the
+ *					interface and don't reply for it
  */
 
 #include <linux/module.h>
@@ -326,12 +328,23 @@
 static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
 {
 	u32 saddr;
+	int from_skb;
+	struct in_device *in_dev2 = NULL;
+	struct net_device *dev2 = NULL;
 	u8  *dst_ha = NULL;
 	struct net_device *dev = neigh->dev;
 	u32 target = *(u32*)neigh->primary_key;
 	int probes = atomic_read(&neigh->probes);
 
-	if (skb && inet_addr_type(skb->nh.iph->saddr) == RTN_LOCAL)
+	from_skb = (skb &&
+		(dev2 = ip_dev_find(skb->nh.iph->saddr)) != NULL &&
+		(in_dev2 = in_dev_get(dev2)) != NULL &&
+		!IN_DEV_HIDDEN(in_dev2));
+	if (dev2) {
+		if (in_dev2) in_dev_put(in_dev2);
+		dev_put(dev2);
+	}
+	if (from_skb)
 		saddr = skb->nh.iph->saddr;
 	else
 		saddr = inet_select_addr(dev, target, RT_SCOPE_LINK);
@@ -763,9 +776,22 @@
 
 	/* Special case: IPv4 duplicate address detection packet (RFC2131) */
 	if (sip == 0) {
-		if (arp->ar_op == htons(ARPOP_REQUEST) &&
-		    inet_addr_type(tip) == RTN_LOCAL)
+		int reply;
+		struct net_device *dev2 = NULL;
+		struct in_device *in_dev2 = NULL;
+
+		reply =
+		    (arp->ar_op == htons(ARPOP_REQUEST) &&
+		    (dev2 = ip_dev_find(tip)) != NULL &&
+		    (dev2 == dev ||
+		    ((in_dev2 = in_dev_get(dev2)) != NULL &&
+		    !IN_DEV_HIDDEN(in_dev2))));
+		if (dev2) {
+		    if (in_dev2) in_dev_put(in_dev2);
+		    dev_put(dev2);
+		    if (reply)
 			arp_send(ARPOP_REPLY,ETH_P_ARP,tip,dev,tip,sha,dev->dev_addr,dev->dev_addr);
+		}
 		goto out;
 	}
 
@@ -779,6 +805,21 @@
 			n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
 			if (n) {
 				int dont_send = 0;
+				if (ipv4_devconf.hidden &&
+				    skb->pkt_type != PACKET_HOST) {
+					struct net_device *dev2 = NULL;
+					struct in_device *in_dev2 = NULL;
+
+					dont_send |=
+					  ((dev2 = ip_dev_find(tip)) != NULL &&
+					  dev2 != dev &&
+					  (in_dev2=in_dev_get(dev2)) != NULL &&
+					  IN_DEV_HIDDEN(in_dev2));
+					if (dev2) {
+					    if (in_dev2) in_dev_put(in_dev2);
+					    dev_put(dev2);
+					}
+				}
 				if (IN_DEV_ARPFILTER(in_dev))
 					dont_send |= arp_filter(sip,tip,dev); 
 				if (!dont_send)
diff -ur v2.6.3/linux/net/ipv4/devinet.c linux/net/ipv4/devinet.c
--- v2.6.3/linux/net/ipv4/devinet.c	2004-02-19 00:13:38.000000000 +0200
+++ linux/net/ipv4/devinet.c	2004-02-19 00:17:08.454422256 +0200
@@ -790,7 +790,8 @@
 
 		read_lock(&in_dev->lock);
 		for_primary_ifa(in_dev) {
-			if (ifa->ifa_scope != RT_SCOPE_LINK &&
+			if (!IN_DEV_HIDDEN(in_dev) &&
+			    ifa->ifa_scope != RT_SCOPE_LINK &&
 			    ifa->ifa_scope <= scope) {
 				read_unlock(&in_dev->lock);
 				addr = ifa->ifa_local;
@@ -1132,7 +1133,7 @@
 
 static struct devinet_sysctl_table {
 	struct ctl_table_header *sysctl_header;
-	ctl_table		devinet_vars[18];
+	ctl_table		devinet_vars[19];
 	ctl_table		devinet_dev[2];
 	ctl_table		devinet_conf_dir[2];
 	ctl_table		devinet_proto_dir[2];
@@ -1244,6 +1245,14 @@
 			.proc_handler	= &proc_dointvec,
 		},
 		{
+			.ctl_name	= NET_IPV4_CONF_HIDDEN,
+			.procname	= "hidden",
+			.data		= &ipv4_devconf.hidden,
+			.maxlen		= sizeof(int),
+			.mode		= 0644,
+			.proc_handler	= &proc_dointvec,
+		},
+		{
 			.ctl_name	= NET_IPV4_CONF_ARPFILTER,
 			.procname	= "arp_filter",
 			.data		= &ipv4_devconf.arp_filter,
