ARP – How Are MAC Changes for an IP Detected?

arpmac address

Assume a simple IPv4 network where all machines are on the same subnet and share a single switch.

If an IP moves to another MAC, how are Layer 3 clients supposed to detect that change? Will a client keep trying on the old MAC until its ARP cache times out, or will it do something smarter? Is it dependent on OS/networking stack?

I'm dealing with a case where a GARP announce was made by the overtaking MAC, but it was missed by some clients who weren't connected at that point in time.

Best Answer

Clients will use the ARP cache entry as long as it's valid. How long that is depends on the OS. On a Cisco router, it's 4 hours. On a Windows PC, it's a random value (really!) between 15 and 45 seconds. Most Linux systems use 60 seconds.