In Linux, is there a different arp cache timeout for non existent hosts?

At my router,, i'm seeing aprox. 8 new entries every 10 seconds for an IP that has been down for a long time.

Sample output from tcpdump -n -i eth1 broadcast:

18:54:21.107848 arp who-has tell
18:54:21.607919 arp who-has tell
18:54:22.107922 arp who-has tell

gc_stale_time is set to 200:

# cat /proc/sys/net/ipv4/neigh/eth1/gc_stale_time 

And yes, this ip is on my arp table:

arp -an | grep
? ( at <incomplete> on eth1

Why it keeps sending so many requests every 10 seconds?

  • Since the system is gone, have you removed any firewall/NAT entries you had for that system?
    – Zoredache
    Feb 10, 2012 at 19:24

1 Answer 1


This is probably not your router which do the requests by itself. Another computer want to contact using your router. So the router just try to do its job.

This should help you to find which computer is faulty:

    tcpdump -n -i dst

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .