Dupliate ARP Table Entries - Is this a bug



  • I am getting duplicate entries in the ARP Table.  Here is what I did:

    • I changed the IP address on a machine with a reserved IP address.

    • I released and renewed the ip on that machine and verified that the ip address had changed.

    • I then viewed the ARP table - and I had a duplicate entry.

    I'm not exactly sure how long it took to disappear, but when I checked back about an hour later and the duplicate entry was gone.

    Did I find a bug, or is this normal operation for some reason?



  • Normal, with every OS. ARP caches aren't cleared because a device changes IPs. The ARP cache lifetime is 20 minutes, it'll stay there for that long past its last usage.



  • @cmb:

    Normal, with every OS. ARP caches aren't cleared because a device changes IPs. The ARP cache lifetime is 20 minutes, it'll stay there for that long past its last usage.

    Will dupe entries cause any problems?  If so, what is the work around?

    Thanks..



  • No.


  • Rebel Alliance Global Moderator

    What OS are you using that arp is 20 minutes?

    netsh interface ipv4 show interface 13

    Interface Local Parameters
    –--------------------------------------------
    IfLuid                            : ethernet_10
    IfIndex                            : 13
    State                              : connected
    Metric                            : 10
    Link MTU                          : 1500 bytes
    Reachable Time                    : 41500 ms

    So your looking at 41 sec's before it goes stale

    Never heard of a arp cache being anywhere near 20 minutes.. 2 minutes would be a long cache..

    Windows has some random factor for how long something is cached as reachable, then it would be marked stale.. Same with linux its going to be in the reachable state but go to stale very quickly.. If its stale normally garbage collection will clear it out in 5 or 10 minutes TOPs..

    arp cache is very short, going to be less than 20 minutes that is for sure..



  • @johnpoz:

    What OS are you using that arp is 20 minutes?

    FreeBSD (as he's talking about the host's own ARP cache).

    ? (x.x.x.x) at 00:17:10:86:b6:a1 on igb0 expires in 1199 seconds [ethernet]
    
    

    It's 1200 seconds upon initial resolution.


  • Rebel Alliance Global Moderator

    Learn something new every day, thanks cmb..