What is the expected behaviour of the ARP cache?

Question

I am familiar with the arp cache being relative to the default age timer regardless of whether a packet has been seen or not and that the router should refresh entries by sending an update arp request before the default 240 mins have expired in Cisco, however...

a) Do the entries from host mac addresses always get flushed when physical cables are unplugged?

b) Is this platform dependent and does the behaviour vary amongst different vendors too?

c) Not sure if it is a bug/card issue or not but i am seeing an entry retained even when the line protocol is down, so would appreciate views on the expected behaviour?

Answer 1

Remember that your ARP table and your MAC address table (CAM) are two separate tables that are not tied together in any sense (at least on any platform I recall).

The ARP table does not have any awareness of the port state, so removing a device from the network does not remove it from the ARP table.

As far as the MAC address table, when a port on the local switch goes down, it will flush the MAC address entries for that port. However, upstream switches will not have this awareness and will continue to have this entry in their MAC address tables until it ages out.

So, to answer your specific questions:

1. When a cable is unplugged, the MAC address for stations on that link are removed from the MAC address table, but the corresponding ARP entries are not removed from the ARP table.
2. This behavior is largely consistent in my experience, however since I don't have experience with all vendors and every platform from each vendor, I cannot say this is true with all of them.
3. Per #1 above, you will most likely continue to see ARP entries until they age out, even after the line protocol is down as only the MAC address table entries are removed.