In this demonstration,
we'll be taking a look at using a Cisco router to understand how
Layer-3 network devices handle ARP within the network.
We'll review the ARP cache and understand the
differences between how a gateway device,
like a Layer-3 switch or router, handle ARP differently from how hosts handle it,
in particular,
how the timers and behavior are more suited to a network packet
forwarding device than an end point system.
I'll show you how to clear single entries and the
affect this has on network systems.
Then you'll see how and why clearing a single entry or the
entire cache can be used for fixing certain ARP cache stale
entries within network Layer-3 devices.
Although, not used very often anymore, you'll learn the use case and how to add,
update, and remove static ARP entries into the routers ARP table.
Due to long ARP cache timers found in Cisco routers,
it may be useful, dependent on your LAN,
to reduce or increase the ARP cache timers associated with interface.
We'll close out showing you how to set those timers using Cisco's iOS,
First, let's take a look at the ARP cache within the router.
We can use either show arp or show ip arp,
the only difference in the output is that only IP based network ARP
information will be shown by the show ip arp command.
In this case, we only have IP networks, so the output is the same.
The table is much like a host system ARP cache in that it
holds IP addresses map to MAC addresses for communication
over a particular network type, arpa for ethernet,
and is associated with interface cards in the last column.
Since a router has multiple active network cards,
you can see that entries for systems on our LAN are
connected to the fast ethernet 0/0 interface,
while the fast ethernet 0/1 only has 2 entries,
1 for the local routers fast ethernet 0/1 interface
and 1 for the next router at 30.
0.
2.
A bit of difference here from host is that the router's own
interfaces appear in the ARP cache list.
The local interfaces 20.
1.
1 and 30.
0.
3 can be spotted because of the age column, it has a dash in it.
That dash means that those entries are statically entered and will not time out.
Another more significant difference is the amount of
aging time associated with these entries.
Compared to host, which age out entries in a matter of minutes,
these can last hours.
So let's check out the default maximum aging timer
associated with Cisco's fast ethernet 0/0.
I'll use the show interfaces fastethernet 0/0 command.
Whoa!
The default is set to 4 hours.
To understand why this is,
we need to know that a router or a Layer-3 switch's primary purpose
is forwarding data to reduce the overhead used to manage dynamic ARP
on the router and improve the forwarding of data to systems with
which it communicates often.
This timer is set rather long.
If that timer were set too short,
routers would be spending too much time keeping their ARP cache
entries up to date and be less able to forward the data.
Considering the likelihood of a systems IP and MAC
binding changing within 4 hours,
this longer timer is a pretty good tradeoff between keeping the ARP
cache current and reducing the routers ARP overhead.
So let's go take a look at how we can clear individual ARP entries,
clear the ARP cache, set, change, and remove static ARP entries,
and later on, be able to change those long ARP cache timers on an interface.
Let's take a look again at our ARP cache.
The command used to clear ARP cache entries is clear arp-cache.
Notice that you can either enter a particular IP address
or enter an interface name and designation to completely
clear all the dynamic entries.
To see what happens, I'm going to run Wireshark on computer 20.
1.
4 while I clear that ARP entry on the router.
I'll start my Wireshark on my host 20.
1.
4, start my capture on ethernet0,
and return to my router where I'll clear the ARP cache entry for 20.
1.
4.
Then we'll use the show arp command again to view the ARP cache.
Notice that since the computer 20.
1.
4 is still on the network,
the ARP entry is still there and the aging timer has been returned to 0.
This is because when I cleared that entry,
the router immediately generated a directed ARP request to the host 20.
1.
4 to verify it's still at that IP and MAC address
and update the router's ARP cache.
Let's go take a look in Wireshark.
I'll add an ARP display filter so that we can just see the ARP traffic.
If we look at this packet number 13,
this was generated at the exact moment when I cleared the host 20.
1.
4 from the router's ARP cache.
When I cleared that host,
the router immediately generated a directed ARP request to find out who has 20.
1.
4 and for that system to tell 20.
1.
In this way,
the router is proactively querying to see if that host is
alive or if there is an IP to MAC address change in an
effort to keep its ARP cache fresh.
Notice this is immediately followed by a broadcast ARP.
In the Info column, it calls this a gratuitous ARP for 20.
1.
Let's take a look at those packet details.
This gratuitous ARP is a very friendly broadcast reminder to the entire
network to let everyone know that the IP address 20.
1.
1 is still at the MAC address 00:23:5e:e2:5f:ee.
In this way,
the router keeps stale or cleared ARP cache entries up-to-date for the
network and helps refresh the computers on the LAN.
Looking at the next packet, number 15, we can see the ARP reply from 20.
1.
4.
Since the computer 20.
1.
4 is still on, of course,
it then naturally responded to the routers directed
ARP request with an ARP reply.
20.
1.
4 is at the MAC address 00:0c:29:f2:ac:34.
In this way,
the router was able to update its ARP cache for this
host and reset its aging timer to 0.
If this computer were off,
the router would not have received this reply and would have marked that entry
within its ARP cache as stale and a candidate for removal.
Let's return to our router and see what happens when I clear the
entire ARP cache for the interface fastethernet 0/0.
I'll repeat my clear arp-cache command changing the IP address to the name of
the interface for which I want to clear all the entries.
Now that I've cleared all the dynamic entries on fastethernet 0/0,
notice the aging timer column.
All of the dynamic entries have their aging time set to 0
on fastethernet 0/0 with 1 exception, 20.
1.
8.
The only reason this system has not been reset to 0 is that
system is powered off and the router is actively still trying
to determine if that system is alive.
All the other systems which have their aging time returned to 0 have
returned an ARP reply to the router's ARP request.
If 20.
1.
8 does not respond to the router's ARP request within a certain amount of time,
it will be removed from the ARP cache.
Let's take a look at this in Wireshark.
Here we can see a gratuitous ARP again telling the network
the router's IP address and MAC address.
Then we can see a series of directed ARP requests and ARP replies
from stations on the network that are still alive.
Who has 20.
1.
5?
20.
1.
5 is at this MAC address.
Who has 20.
1.
4?
20.
1.
4 is at this MAC address.
Again, notice that 20.
1.
8 is no longer responding to the ARP requests.
This is an indicator that system is no longer connected to the network
or no longer answering those ARP requests and will be a candidate for
removal from the Cisco routers ARP cache.
Since 20.
1.
8 hasn't answered any of the Cisco router's ARP requests,
it was removed from the ARP cache.
Next, let's take a look at how to add and remove static entries.
This is done using the global configuration command arp.
Again,
let's say I want to add a static entry to reduce ARP
overhead or reduce ARP poisoning threats.
Particularly, for a server,
which will always be a set known IP address and set known MAC addresses.
I'll issue the ARP command with the IP address of that server, 20.
1.
90.
I'll then have to add the MAC address in Cisco's format,
in this case, it'll be the dummy MAC address 1111.
bbbb.
cccc.
Next,
I'll need to tell the router what type of ARP network this is participating in.
In this case, arpa is the keyword used for ethernet.
Now when we look in our ARP cache, we'll see that static entry for 20.
1.
90 at the particular MAC address.
Now should that entry ever need to change,
I can reissue the command to make an update.
Or should I ever need to delete that entry,
I can reissue the command with no at the beginning to erase it from the cache.
Lastly, let's take a look at how to change that for our ARP cache timer.
Although,
reducing this will generate more ARP traffic and more
processing overhead on the router,
Cisco does recommend that if the network has frequent changes to cache entries,
the default should be changed to a shorter time period.
The change is a relatively simple one to make.
We'll move to the interface on which we want to make the change,
then issue the command arp timeout and the number of
seconds we want to set the timeout for.
Make note that when you show the ARP cache table,
it shows the time in minutes,
but you will need to add the time here in seconds because
if you set the aging timeout to 30 here,
you won't be setting it to 30 minutes, but 30 seconds.
So if you want 30 minutes, make sure you convert it to seconds and enter 1800.
Now we can see our ARP timer is set to 30 minutes.
If you ever want to return it to its default,
but cannot remember the time or the seconds,
just use the command default ARP timeout, this will reset the timer for that interface back to its defaults.