D-Link DFL-210 - NetDefend - Security Appliance, User Manual

Page: 95 / 469

The default expiration time for dynamic ARP entries is 900 seconds (15 minutes). This can be
changed by modifying the advanced setting ARP Expire.
The setting ARP Expire Unknown specifies how long NetDefendOS will remember addresses that
cannot be reached. This is done to ensure that NetDefendOS does not continuously request such
addresses. The default value for this setting is 3 seconds.
Example 3.14. Displaying the ARP Cache
The contents of the ARP Cache can be displayed from within the CLI.
CLI
gw-world:/> arp -show
ARP cache of iface lan
Dynamic 10.4.0.1 = 1000:0000:4009 Expire=196
Dynamic 10.4.0.165 = 0002:a529:1f65 Expire=506
Flushing the ARP Cache
If a host in your network has recently been replaced with a new hardware but keeping the same IP
address, it is most likely to have a new Ethernet address. If NetDefendOS has an ARP entry for that
host, the Ethernet address of that entry will be invalid, causing data sent to the host to never reach its
destination.
Naturally, after the ARP expiration time, NetDefendOS will learn the new Ethernet address of the
requested host, but sometimes it might be necessary to manually force a re-query. This is easiest
achieved by flushing the ARP cache, an operation which will delete all dynamic ARP entries from
the cache, thereby forcing NetDefendOS to issue new ARP queries.
Example 3.15. Flushing the ARP Cache
This example shows how to flush the ARP Cache from within the CLI.
CLI
gw-world:/> arp -flush
ARP cache of all interfaces flushed.
Size of the ARP Cache
By default, the ARP Cache is able to hold 4096 ARP entries at the same time. This is feasible for
most deployments, but in rare occasions, such as when there are several very large LANs directly
connected to the firewall, it might be necessary to adjust this value. This can be done by modifying
the advanced setting ARP Cache Size.
So-called "hash tables" are used to rapidly look up entries in the ARP Cache. For maximum
efficiency, a hash should be twice as large as the table it is indexing, so if the largest
directly-connected LAN contains 500 IP addresses, the size of the ARP entry hash should be at least
1000 entries. The administrator can modify the advanced setting ARP Hash Size to reflect specific
network requirements. The default value of this setting is 512.
The setting ARP Hash Size VLAN setting is similar to the ARP Hash Size setting, but affects the
3.4.3. ARP Cache Chapter 3. Fundamentals
95