Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In Linux, is there a different arp cache timeout for non existent hosts?

At my router, 192.168.0.1, i'm seeing aprox. 8 new entries every 10 seconds for an IP that has been down for a long time.

Sample output from tcpdump -n -i eth1 broadcast:

18:54:21.107848 arp who-has 192.168.0.45 tell 192.168.0.1
18:54:21.607919 arp who-has 192.168.0.45 tell 192.168.0.1
18:54:22.107922 arp who-has 192.168.0.45 tell 192.168.0.1

gc_stale_time is set to 200:

# cat /proc/sys/net/ipv4/neigh/eth1/gc_stale_time 
200

And yes, this ip is on my arp table:

arp -an | grep 192.168.0.45
? (192.168.0.45) at <incomplete> on eth1

Why it keeps sending so many requests every 10 seconds?

share|improve this question
    
Since the system is gone, have you removed any firewall/NAT entries you had for that system? –  Zoredache Feb 10 '12 at 19:24

1 Answer 1

This is probably not your router which do the requests by itself. Another computer want to contact 192.168.0.45 using your router. So the router just try to do its job.

This should help you to find which computer is faulty:

    tcpdump -n -i dst 192.168.0.45
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.