Router ARP Cache is Not Releasing Linux / UNIX Server IP address

by nixCraft on January 25, 2008 · 5 comments· last updated at January 25, 2008

Q. Recently we made changes to our server hardware and swapped all IP address from old to a new server. However, 2 IP addresses are not get updated due to arp cache issues (IPs are cached on the router). They are going to other servers. How do I solve this problem under Redhat Enterprise Linux version 5.0 or any other Linux distribution?

A. ARP is used to resolve IP address to the corresponding Ethernet address. ARP maintains the mapping between IP address and MAC address in a table in memory called ARP cache. The entries in this table are dynamically added and removed.

This is common and well known problem. Most ISPs and network admin configure their routers with a long ARP cache timeout. As a result your requests are going to other server. If you move IP address it may take hours before server can communicate with the Internet (correct server). To get rid of this problem you need to request the MAC address for its own IP which will cause routers and other hardware update ARP cache. This is called as 'unsolicited ARP' or 'gratuitous ARP'.

arping command - To sends an ARP request to resolve its own IP address (gratuitous ARP)

There are two versions of arping, you need a version written by Alexey Kuznetsov. Both Debian and RHEL has Alexey arping command version. Type the following command to update arp cache:
# arping -U -I {Interface-Name} {IP-Address} # arping -U -I eth1 72.2.1.2
Where,

-U : Unsolicited ARP mode to update neighbours’ ARP caches. No replies are expected.
-I eth1 : Name of network device where to send ARP REQUEST packets. This is required.
72.2.1.2 : IP address

There is also another tool called send_arp from the High-Availability Linux Project for same purpose.

You should follow me on twitter here or grab rss feed to keep track of new changes.

Featured Articles:

{ 5 comments… read them below or add one }

1 Emil Obermayr January 25, 2008 at 12:16 pm

You can use /sbin/arp with option -a to show the current arp table. And then use option -d to delete the old entry of your server. It will be learned again immediately when needed.

2 Matthew July 7, 2010 at 3:36 pm: I know this is an ancient post, but I wanted to clear this up:
Emil, that doesn’t affect your gateway router’s arp table, which is the source of the problem. If you move an IP between two machines, the gateway loses track of where it is, and tries to send traffic for it to the wrong MAC address. This can also affect managed switches to some degree, although not as much. The trick in the post is the equivalent of making your computer say ‘HEY DUMMY! THE IP IS OVER HERE NOW!”
Reply

3 Fredrik Liljegren May 25, 2009 at 6:37 pm

In debian (lenny) there’s two arping packages: arping and iputils-arping. This article refers to the iputils-arping version.

4 Aaron Couch January 29, 2010 at 5:03 pm

Thank you Fredrik for mentioning that. I was having a lot of trouble because I was using the Thomas Habets version of ‘arping’ http://www.habets.pp.se/synscan/docs/arping.8.html that you get through ‘apt-get install arping’ on debian.

To install the ‘Alexey Kuznetsov’ version you need to use ‘apt-get install iputils-arping’ which uses the syntax above.

5 Ade B October 25, 2010 at 8:15 pm