Address Resolution Protocol (ARP) Cache Functions (99150)

SUMMARY

This article discusses the ARP cache, how it manages its resources and its problem with duplicate IP addresses.

WHAT IS IT?

The address resolution protocol (ARP) cache is a table in computer memory that maps a limited number of IP addresses to their physical adapter addresses. A computer's ARP cache contains its own entry, entries for machines that have made ARP broadcasts to it, and entries for machines to which it has made broadcasts.

ARP CACHE SIZE

ARP cache size is controlled by the "arptblsize" parameter in the [tcp_xif] section of the PROTOCOL.INI file. The default is (tcpconnections*2)+6. The range is from 6 to 512.

CACHE MANAGEMENT

Each cache entry has a time stamp that the ARP uses to control its resources. To make more room for active entries, the ARP walks through the cache every five minutes and deletes any entry that is more than 15 minutes old and is not for a local machine or default gateway. If the cache becomes full, the ARP clears outdated or remote entries using the same criteria. The time stamp and the maximum time allowed in the cache depend on the implementation and are not to be confused with an IP packet's "time to live" parameter. The cache is flushed when the machine reboots.

DUPLICATE ADDRESSES AND ARP CACHE UPDATES

Duplicate IP addresses can cause ARP problems. Here is an example that shows how:

Machine A's ARP cache has Ethernet address E1 entered for machine B. Machine C starts up, and it has the same IP address of machine B but an Ethernet address of E2. Machine A's ARP cache is updated to reflect the new Ethernet address for that IP address, which can cause serious problems (including hanging the machine) if A is already in a session with B.

To avoid this problem, you have to plan the network so that each machine has a unique IP address.

Microsoft Product Support Services provides a utility for looking at ARP cache contents.