Configuring ARP age timeout [closed]
Asked Answered
C

4

38

I am trying to configure the ARP age timeout. I think I should set /proc/sys/net/ipv4/neigh/default/base_reachable_time_ms to the desired timeout. But although I set this to 30000ms (30sec) it still takes close to 10mins for an entry to get removed from the ARP cache. After reading few articles I see there are few more settings that affect the timeout:

/proc/sys/net/ipv4/neigh/default/gc_interval
/proc/sys/net/ipv4/neigh/default/gc_stale_time
/proc/sys/net/ipv4/route/gc_interval
/proc/sys/net/ipv4/route/gc_timeout

I am not sure what to program for these. The gc_timeout defaults to 5 minutes in Linux. I changed that to 30 seconds but still I don't see the entry getting removed within base_reachable_time/2 or 3*base_reachable_time/2.

How can I set the expiration time for the ARP cache?

Colorfast answered 12/3, 2013 at 20:59 Comment(0)
A
105

The neighbor cache in the Linux kernel isn't as simple as one would think. I'll try to explain some of the quirks with it.

There are subtle differences between an neighbor cache entry actually falling out of the cache entirely or just being marked as stale/invalid. At some point between base_reachable_time/2 and 3*base_reachable_time/2, the entry will still be in the cache, but it will be marked with a state of STALE. You should be able to view the state with "ip -s neighbor show",

pherricoxide@midigaurd:~$ ip -s neighbor list
192.168.42.1 dev eth0 lladdr 00:25:90:7d:7e:cd ref 2 used 184/184/139 probes 4 STALE
192.168.10.2 dev eth0 lladdr 00:1c:23:cf:0b:6a ref 3 used 33/28/0 probes 1 REACHABLE
192.168.10.1 dev eth0 lladdr 00:17:c5:d8:90:a4 ref 219 used 275/4/121 probes 1 REACHABLE

When in the STALE state like show above, if I ping 192.168.42.1, it will send the packet to 00:25:90:7d:7e:cd right away. A second or so later it will usually send an ARP request for who has 192.168.42.1 in order to update it's cache back to a REACHABLE state. BUT, to make matters more confusing, the kernel will sometimes change timeout values based on positive feedback from higher level protocols. What this means is that if I ping 192.168.42.1 and it replies, then the kernel might not bother sending an ARP request because it assumes that the pong meant that it's ARP cache entry is valid. If the entry is in the STALE state, it will also be updated by unsolicited ARP replies that it happens to see.

Now, for the majority of cases, the entry being in the STALE state is all you need to worry about. Why do you need the entry to be removed from the cache entirely? The kernel goes to a lot of effort to not thrash memory by just changing the state of cache entries instead of actually removing and adding them to the cache all the time.

If you really really insist that it not only will be marked as STALE, but will actually be removed from the hashmap used by the neighbor cache, you have to beware of a few things. First, if the entry hasn't been used and is stale for gc_stale_time seconds, it should be eligible to be removed. If gc_stale_time passed and marked the entry as okay to be removed, it will be removed when the garbage collector runs (usually after gc_interval seconds).

Now the problem is that the neighbor entry will not be deleted if it's being referenced. The main thing that you're going to have problems with is the reference from the ipv4 routing table. There's a lot of complicated garbage collection stuff, but the important thing to note is that the garbage collector for the route cache only expires entries every 5 minutes (/proc/sys/net/ipv4/route/gc_timeout seconds) on a lot of kernels. This means the neighbor entry will have to be marked as stale (maybe 30 seconds, depending on base_reachable_time), then 5 minutes will have to go by before the route cache stops referencing the entry (if you're lucky), followed by some combination of gc_stale_time and gc_interval passing before it actually gets cleaned up (so, overall, somewhere between 5-10 minutes will pass).

Summary: you can try decreasing /proc/sys/net/ipv4/route/gc_timeout to a shorter value, but there are a lot of variables and it's difficult to control them all. There's a lot of effort put in to making things perform well by not removing entries in the cache too early (but instead just marking them as STALE or even FAILED).

Augustinaaugustine answered 19/3, 2013 at 21:47 Comment(2)
This is all very interesting, but I dare to ask: why is there no way of manually forcing a cache cleanup? I understand that this will make the system perform poorly, but by doing a manual clean-up you are already prepared for this. Instead, the only way I know of clearing the arp cache (sudo ip -s -s neigh flush all) will mark entries as invalid, but not remove them from the cache. This is very counter-intuitive. IMO, there should be a flag somewhere to tell the system "really clean the cache, I am responsible for any problems that will happen from now on".Kelby
arp -d <ip_address will remove a particular entryInconveniency
G
3
ip link set arp off dev eth0; ip link set arp on dev eth0
Genitor answered 21/4, 2016 at 23:3 Comment(1)
If you plan to down, then up the interface - AND it's the interface you are connected to the host through, then be sure to chain the commands on the same line before you press Enter! (better yet, do it from a screen session...)Sinasinai
H
0

The simplest way to completely clean the arp cache is to bring the interface down and then up again. Clearly this has lot more implications, e.g., possibly breaking ongoing TCP connections, being unreachable for a while, etc. But that seems to be the only means to really remove an entry from the arp cache in the latest kernels :(

Houseman answered 23/10, 2015 at 8:26 Comment(0)
U
0

This is what I set:

sudo -s then enter:

echo 30 > /proc/sys/net/ipv4/neigh/default/gc_stale_time
echo 175 > /proc/sys/net/ipv4/route/gc_timeout
echo 20000 > /proc/sys/net/ipv4/neigh/default/base_reachable_time_ms
echo 30 > /proc/sys/net/ipv4/route/gc_interval
Urey answered 3/3, 2021 at 2:20 Comment(0)

© 2022 - 2024 — McMap. All rights reserved.