Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

In Linux, is there a different arp cache timeout for non existent hosts?

At my router,, i'm seeing aprox. 8 new entries every 10 seconds for an IP that has been down for a long time.

Sample output from tcpdump -n -i eth1 broadcast:

18:54:21.107848 arp who-has tell
18:54:21.607919 arp who-has tell
18:54:22.107922 arp who-has tell

gc_stale_time is set to 200:

# cat /proc/sys/net/ipv4/neigh/eth1/gc_stale_time 

And yes, this ip is on my arp table:

arp -an | grep
? ( at <incomplete> on eth1

Why it keeps sending so many requests every 10 seconds?

share|improve this question
Since the system is gone, have you removed any firewall/NAT entries you had for that system? – Zoredache Feb 10 '12 at 19:24

1 Answer 1

This is probably not your router which do the requests by itself. Another computer want to contact using your router. So the router just try to do its job.

This should help you to find which computer is faulty:

    tcpdump -n -i dst
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.