Arp entry cached

[CSG Office]

Hello everyone,

I have an HPUX 11.11 system (server3) that is having an arp issue. An incorrect entry was placed in the /etc/hosts table. The /etc/nsswitch.conf file has "hosts: files dns". The hosts entry were something like this:

192.168.0.10 server2
192.168.0.10 server1
192.168.0.11 server2

When pinging server1, no problem. However, when the problem was found, "192.168.0.10 server2" was removed. At this point:

$ nslookup 192.168.0.10
Using /etc/hosts on: server3

looking up FILES
Name: server1
Address: 192.168.0.10

However, the arp entry is still:

$ arp -a | grep 192.168.0.10
server2 (192.168.0.10) at xx:xx:xx:xx:xx:xx ether

I need that to resolve correctly in arp, so:
$ arp -d server2
server2 (192.168.0.10) deleted
$ arp -d 192.168.0.10
192.168.0.10 (192.168.0.10) - - no entry

Now it should resolve correctly. So:

$ ping server1
PING server1: 64 byte packets
....
All return correctly
$ arp -a | grep 192.168.0.10
server2 (192.168.0.10) at xx:xx:xx:xx:xx:xx ether

I also tried:
$ arp -d server2
$ arp -s server1 xx:xx:xx:xx:xx:xx
$ arp -a | grep 192.168.0.10
server2 (192.168.0.10) at xx:xx:xx:xx:xx:xx ether permanent

Does anyone know how I can clear the cached info without rebooting the system?

[Florian Heigl (new acc)]

arp -a -d or arp -d -a (i don't know which way round :) will clear the whole arp cache, definitely, BUT it might take some time until the new address is 'learned' by the system and / or switches along the way.

after 30 seconds of pinging from both ends, things should definitely resolve, otherwise You might want to use tcpdump and look at the arp packets sent in and out.

as it appears arp -s didn't fix things for You, the issue might be ... not on this host ...

[CSG Office]

It appears that niether "arp -a -d" nor "arp -d -a" work. The "-d" option wants a hostname. It also will not take wildcards. One more note, a reboot did not solve it. I "arp -d 192.168.0.10" just before rebooting as well.

I have reconfirmed that the files and dns return the correct information for 192.168.0.10, server1 and server2.

There has to be a cache file somewhere for either the name resolution or arp table. Does anyone know where I can find them?

[Arunvijai_4]

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=12530
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=575677

-Arun

[John E.Ophious]

G'day mate,

Sounds like you have a cache file issue. Clearing that out and rebooting should help.

Peace on Earth,

John E. Ophious

[rick jones]

If you rebooted the server and still see what you believe to be the wrong MAC address associated with the IP address in question it means either:

a) some other machine has been configured with that IP address

b) your asusmption as to the correct MAC address was incorrect

HP-UX does not cache arp entries from one boot to the other.

[CSG Office]

The mystery is solved. The /etc/hosts file is several hundred lines long. Even though a query resolved correctly against the hosts file, there was still a duplicate entry. Once removed, everything is working correctly. I believe there is a bug in HPUX 11.11 though. The tools for resolving the IP->host and host->IP always came back correct. However, the resolver of arp kept finding the incorrect entry.