IP arp entries repeatedly being refreshed

[cjbennett]

Investigating a problem I noted that the arp entry on a Cisco 5500 RSM (11.2) for an IP (NT Server) address is apparently getting refreshed ever 0-10 minutes.

A "show ip arp a.b.c.d" shows the "Age" consistently less than 10 minutes, typically 1-2 minutes.

What are the possible reasons that an arp entry will be refreshed? Usually arp entries age out after the default limit, but never so quicly as this.

Why would the router discard/refresh an arp entry?

[wkumari]

This sounds like Gratuitous ARP replies. What is supposed to happen is that when a machine gets a new IP (or siezes an IP using VRRP) or something similar, the machine send out a gratuitous ARP (gratuitous because it wasn't requested). Sometimes NT appers to go a little wonky and just keeps sending them. You may want to look at: http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q219374&

--Warren.

[t.baranski]

Some ARP implementations reset the age of cached entries whenever they see an ARP request (for any address -- doesn't matter) from the machine in question. This is correct behavior as per the RFC.