1

In Linux, an ARP entry's age gets reset/refreshed if a packet comes by. However, it seems that FreeBSD simply sets a timer, and unconditionally evicts the ARP entry even if packets with that MAC-address/IP came by. Is there a way to get Linux's behaviour of updating the age if traffic is seen?

I am experiencing large bursts of ARP broadcast traffic every 20 minutes on my LAN because of this. I know that one can change the age in FreeBSD's cache, but that just changes the intervals between bursts. I want to stop the bursts in the first place.

Improve this question

1 Answer 1

Reset to default
0

The great thing about FreeBSD is that things are documented: arp(4)

We have:

These routes time out periodically (normally 20 minutes after validated; entries are not validated when not in use)

...and...

max_age How long an ARP entry is held in the cache until it needs to be refreshed. Default is 1200 seconds.

I read that as if we see the entry within maxage then it is validated. That is: When in use it is validated.

So if you do a:

arp -i ixl0 -a
? (192.168.1.2) at 00:00:00:00:00:00 on ixl0 expires in 237 seconds [ethernet]
? (192.168.1.1) at 00:00:00:00:00:01 on ixl0 permanent [ethernet]

You will see the arp entries and their age. If you want to extend the cache duration simply change max_age.

Improve this answer
3
  • I know about the max age, I've also tried to explain how this still differs from, e.g., Linux' implementation and many other platforms. I get an enormous arp broadcast storm each 20 minutes.. doesn't really matter if this is every 20min or every hour
    – hbogert
    Jan 8, 2019 at 16:25
  • I think you have a different problem. But as you have already explained everything including the required answer - good luck with that. Asking a question and including the facts might gain more traction.
    – Claus Andersen
    Jan 8, 2019 at 16:57
  • Indeed, there is a deeper problem in my scenario, but all other possible solution are a dead end. But I don't think I gave the answer myself.. unless you think I should ditch pfSense for a linux-based distro
    – hbogert
    Jan 8, 2019 at 22:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.