4

Assume a simple IPv4 network where all machines are on the same subnet and share a single switch.

If an IP moves to another MAC, how are Layer 3 clients supposed to detect that change? Will a client keep trying on the old MAC until its ARP cache times out, or will it do something smarter? Is it dependent on OS/networking stack?

I'm dealing with a case where a GARP announce was made by the overtaking MAC, but it was missed by some clients who weren't connected at that point in time.

Improve this question
3
  • If anyone wants a working solution for this problem, have a look at keepalived and their garp_master_refresh feature: github.com/acassen/keepalived/commit/…
    – Alexander Torstling
    Commented May 18, 2015 at 7:34
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 11, 2017 at 4:08
  • @RonMaupin Sure thing. I've marked Ron Trunks answer as the correct one. The cache is OS-dependent and that you really need a periodic GARP to avoid clients missing the initial GARP.
    – Alexander Torstling
    Commented Aug 11, 2017 at 9:41

2 Answers 2

Reset to default
3

Clients will use the ARP cache entry as long as it's valid. How long that is depends on the OS. On a Cisco router, it's 4 hours. On a Windows PC, it's a random value (really!) between 15 and 45 seconds. Most Linux systems use 60 seconds.

Improve this answer
8
  • Thank you for your answer. Will the Cisco router not clear its cache entry after a number of failures or if someone else joins the network and ARPs and gets the new MAC?
    – Alexander Torstling
    Commented Feb 11, 2015 at 15:24
  • Are you sure about 4 hours? I'm fairly certain that MAC table aging time is 4 hours - default ARP timeout should be 5 minutes.
    – John Jensen
    Commented Feb 11, 2015 at 20:47
  • Digging further it appears to vary between hardware platforms (naturally). Some are 5 minutes for MAC/ARP table entries, some are 4 hours for both. Sigh.
    – John Jensen
    Commented Feb 11, 2015 at 20:55
  • I'll admit to not having surveyed the entire product line. Which ones have a five minute aging time? That seems awfully short to me.
    – Ron Trunk
    Commented Feb 11, 2015 at 21:01
  • @JohnJensen Ricky's answer had correct timer values. You seem to be mixing cam and arp timers
    – Mike Pennington
    Commented Feb 11, 2015 at 21:40
1

If a new host takes over an IP address it should announce it with a Gratuitous ARP.

You said some hosts didn't pick it up because they were not connected, but that's not how it works. If those hosts were not connected, they shouldn't have an ARP table in the first place. As they don't have any entries for that IP address at all, they should ask for it with a broadcast ARP query (who's got x.x.x.x? tell y.y.y.y).

Improve this answer
2
  • They were temporarily gone due to a switch failure. So they did have ARP entries for the host. I'm trying to figure out when the tables are refreshed though.
    – Alexander Torstling
    Commented Mar 14, 2015 at 20:26
  • 1
    @AlexanderTorstling They are refreshed purely based upon an aging time. If a host acquired a new IP address, it typically issues a Gratuitous ARP up to three times, but typically won't "keep" announcing it periodically. If a neighboring host missed the initial GARPs, they are out of luck until their ARP cache time out for that entry.
    – Eddie
    Commented May 14, 2015 at 8:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.