[c-nsp] ARP behavior

[Chuck Church]

Hey all,

 

                I'm curious as to how ARP behaves on a LAN.  After looking
at a router with high amounts of process switched traffic, I discovered
that it's mostly ARP traffic, both in and out.  Looking at CEF statistics, I
see a lot of encapsulation failed type drops.  Which are tied to an
'Incomplete' entry in the ARP table.  Nothing new there.  But thinking about
it:

 

If a router gets a packet destined to a (potentially) locally connected
Ethernet host, does it ARP for that host (if unknown) for every packet
destined to the host?

 

If not, does it just drop packets for a certain time frame, maybe tied into
how long the 'incomplete' entry stays in the ARP table?

 

Reading the RFC didn't really clarify the behavior, nor did googling 'ARP
incomplete timeout' or other variants.  It's hard to determine how long a
router maintains that 'incomplete' entry.  Anyone have an idea?

 

Thanks,

 

Chuck