How are ARP table entries managed, and how long do they persist?
ARP entries are temporary: each one is removed when the ARP cache timer expires (the timeout depends on the OS), they can be cleared manually by an administrator, and the timer refreshes when an entry is reused.
* A learned mapping is cached, kept alive while reused (timer resets), and removed once the cache timer expires or an admin clears it. *
ARP Table Entry Management:
| Characteristic | Description |
|---|---|
| Persistence | Entries are NOT permanent |
| Timeout | Removed when ARP cache timer expires (duration varies by OS) |
| Manual removal | Administrator can manually clear ARP entries |
| Refresh | Timer resets when the mapping is used again |
Typical ARP cache timeout:
- Windows: 15-45 seconds (dynamic)
- Linux: 60 seconds (default)
- Cisco IOS: 4 hours (default)
Why entries expire:
- Devices may change IP addresses
- NICs may be replaced (new MAC)
- Stale entries waste memory and could cause delivery failures
Go deeper:
-
Address Resolution Protocol — ARP caching — Wikipedia on why cached mappings are held only temporarily and aged out. -
RFC 826 — An Ethernet Address Resolution Protocol — the spec's rationale for an aging table so the mappings stay current as hardware changes.