I'm trying to configure sane values for the Linux kernel arp cache timeout, but I can't find a detailed explanation as to how they work anywhere. Even the kernel.org documentation doesn't give a good explanation, I can only find recommended values to alleviate overflow.

Here is an example of the values I have:

net.ipv4.neigh.default.gc_thresh1 = 128
net.ipv4.neigh.default.gc_thresh2 = 512
net.ipv4.neigh.default.gc_thresh3 = 1024

Now, from what I've gathered so far:

  • gc_thresh1 is the number of arp entries allowed before the garbage collector starts removing any entries at all.

  • gc_thresh2 is the soft-limit, which is the number of entries allowed before the garbage collector actively removes arp entries.

  • gc_thresh3 is the hard limit, where entries above this number are aggressively removed.

Now, if I understand correctly, if the number of arp entries goes beyond gc_thresh1 but remains below gc_thresh2, the excess will be removed periodically with an interval set by gc_interval.

My question is, if the number of entries goes beyond gc_thresh2 but below gc_thresh3, or if the number goes beyond gc_thresh3, how are the entries removed? In other words, what does "actively" and "aggressively" removed mean exactly? I assume it means they are removed more frequently than what is defined in gc_interval, but I can't find by how much.

1 Answer 1


Every time when there is a forced garbage collection of entries, last_flush field is updated in the neighbor table, neigh_table.

Forced garbage collection of entries happens if one of the following conditions are met:

  • Number of entries in the table is greater than gc_thresh3
  • Number of entries in the table is greater than gc_thresh2, and time since last_flush is greater than or equal to 5 HZ

When a forced garbage collection of entries is requested, entries that meet both the following criteria are discarded:

  • Nobody refers to the entry
  • Entry is not permanent

A periodic work, neigh_periodic_work tries to free unreferenced entries if the total number of entries is greater than gc_thresh1.

Source: Linux kernel source, neighbour.c

  • OK, I'm not a developer so let me try to see if I understand correctly. Entries less than gc_thresh1 are left alone. Entries above gc_thresh1, but below gc_thresh2 are periodically garbage collected with a frequency set by gc_interval. Entries above gc_thresh2 but below gc_thresh3 are garbage collected every 5 seconds. Entries above gc_thresh3 are garbage collected immediately, triggered by not by a periodical check, but by the event of adding a new entry. Is that accurate?
    – Jak
    Nov 12, 2013 at 10:23
  • That sounds correct from what I observed in the source code. Nov 13, 2013 at 20:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.