I'm trying to configure sane values for the Linux kernel arp cache timeout, but I can't find a detailed explanation as to how they work anywhere. Even the kernel.org documentation doesn't give a good explanation, I can only find recommended values to alleviate overflow.

Here is an example of the values I have:

net.ipv4.neigh.default.gc_thresh1 = 128
net.ipv4.neigh.default.gc_thresh2 = 512
net.ipv4.neigh.default.gc_thresh3 = 1024

Now, from what I've gathered so far:

  • gc_thresh1 is the number of arp entries allowed before the garbage collector starts removing any entries at all.

  • gc_thresh2 is the soft-limit, which is the number of entries allowed before the garbage collector actively removes arp entries.

  • gc_thresh3 is the hard limit, where entries above this number are aggressively removed.

Now, if I understand correctly, if the number of arp entries goes beyond gc_thresh1 but remains below gc_thresh2, the excess will be removed periodically with an interval set by gc_interval.

My question is, if the number of entries goes beyond gc_thresh2 but below gc_thresh3, or if the number goes beyond gc_thresh3, how are the entries removed? In other words, what does "actively" and "aggressively" removed mean exactly? I assume it means they are removed more frequently than what is defined in gc_interval, but I can't find by how much.

1 Answer 1


Every time when there is a forced garbage collection of entries, last_flush field is updated in the neighbor table, neigh_table.

Forced garbage collection of entries happens if one of the following conditions are met:

  • Number of entries in the table is greater than gc_thresh3
  • Number of entries in the table is greater than gc_thresh2, and time since last_flush is greater than or equal to 5 HZ

When a forced garbage collection of entries is requested, entries that meet both the following criteria are discarded:

  • Nobody refers to the entry
  • Entry is not permanent

A periodic work, neigh_periodic_work tries to free unreferenced entries if the total number of entries is greater than gc_thresh1.

Source: Linux kernel source, neighbour.c

  • OK, I'm not a developer so let me try to see if I understand correctly. Entries less than gc_thresh1 are left alone. Entries above gc_thresh1, but below gc_thresh2 are periodically garbage collected with a frequency set by gc_interval. Entries above gc_thresh2 but below gc_thresh3 are garbage collected every 5 seconds. Entries above gc_thresh3 are garbage collected immediately, triggered by not by a periodical check, but by the event of adding a new entry. Is that accurate?
    – Jak
    Nov 12, 2013 at 10:23
  • That sounds correct from what I observed in the source code. Nov 13, 2013 at 20:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .