1

My network interface actively uses a gateway to send IP packets to other networks. There is already an ARP entry in the cache for the IP/MAC association for the gateway.

Is it normal that my network interface issues a broadcast to get the MAC address of the gateway even though that the entry was being used really frequently to send packets to other networks? Does not retrieving the entry from cache update the time to live of it in the cache? Why are these ARP requests happening?

Improve this question
1
  • 2
    Broadcast is how arp works. One would assume sending/receiving traffic from that node would keep the cache fresh, but not all OSes do that, and will periodically (re)validate the entry.
    – Ricky
    Aug 19, 2018 at 1:02

1 Answer 1

Reset to default
2

The Ethernet layer has no feedback mechanism for destination host unreachable like IP/ICMP.

If the next-hop gateway went offline there would be no way to notice and packets would still be sent to a non-existing MAC address. If another potential gateway with a higher metric existed it wouldn't ever get used.

Therefore, periodic ARP requests are used to detect whether the gateway is still there. It also detects a changed MAC for the gateway (in case of router failover) but this is more frequently signaled by gratuitous ARP from the new gateway.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.