Assume a simple IPv4 network where all machines are on the same subnet and share a single switch.

If an IP moves to another MAC, how are Layer 3 clients supposed to detect that change? Will a client keep trying on the old MAC until its ARP cache times out, or will it do something smarter? Is it dependent on OS/networking stack?

I'm dealing with a case where a GARP announce was made by the overtaking MAC, but it was missed by some clients who weren't connected at that point in time.

  • If anyone wants a working solution for this problem, have a look at keepalived and their garp_master_refresh feature: github.com/acassen/keepalived/commit/… – Alexander Torstling May 18 '15 at 7:34
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 4:08
  • @RonMaupin Sure thing. I've marked Ron Trunks answer as the correct one. The cache is OS-dependent and that you really need a periodic GARP to avoid clients missing the initial GARP. – Alexander Torstling Aug 11 '17 at 9:41

Clients will use the ARP cache entry as long as it's valid. How long that is depends on the OS. On a Cisco router, it's 4 hours. On a Windows PC, it's a random value (really!) between 15 and 45 seconds. Most Linux systems use 60 seconds.

  • Thank you for your answer. Will the Cisco router not clear its cache entry after a number of failures or if someone else joins the network and ARPs and gets the new MAC? – Alexander Torstling Feb 11 '15 at 15:24
  • Are you sure about 4 hours? I'm fairly certain that MAC table aging time is 4 hours - default ARP timeout should be 5 minutes. – John Jensen Feb 11 '15 at 20:47
  • Digging further it appears to vary between hardware platforms (naturally). Some are 5 minutes for MAC/ARP table entries, some are 4 hours for both. Sigh. – John Jensen Feb 11 '15 at 20:55
  • I'll admit to not having surveyed the entire product line. Which ones have a five minute aging time? That seems awfully short to me. – Ron Trunk Feb 11 '15 at 21:01
  • @JohnJensen Ricky's answer had correct timer values. You seem to be mixing cam and arp timers – Mike Pennington Feb 11 '15 at 21:40

If a new host takes over an IP address it should announce it with a Gratuitous ARP.

You said some hosts didn't pick it up because they were not connected, but that's not how it works. If those hosts were not connected, they shouldn't have an ARP table in the first place. As they don't have any entries for that IP address at all, they should ask for it with a broadcast ARP query (who's got x.x.x.x? tell y.y.y.y).

  • They were temporarily gone due to a switch failure. So they did have ARP entries for the host. I'm trying to figure out when the tables are refreshed though. – Alexander Torstling Mar 14 '15 at 20:26
  • 1
    @AlexanderTorstling They are refreshed purely based upon an aging time. If a host acquired a new IP address, it typically issues a Gratuitous ARP up to three times, but typically won't "keep" announcing it periodically. If a neighboring host missed the initial GARPs, they are out of luck until their ARP cache time out for that entry. – Eddie May 14 '15 at 8:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.