Changing your IP address, and the effect it has on ARP caches

Say I'm ip address 192.168.1.15.    And I change my IP address to 192.168.1.20.
Will my router still have my MAC address MAPPED to 192.168.1.15 for a few minutes thereafter?

I've noticed that if I change my IP address, then view traffic with a sniffer. I can sometimes see my OLD IP address still doing ARP requests like a ghost (and no, no one was reassigned my old address). The problem fades away after a few minutes (hours?)

Would the "clear arp cache" command remedy this situation?

Thanks
dissolvedAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JFrederick29Commented:
Yes, the entry in the ARP cache is used until it ages out and then the new MAC address is mapped to the IP address when the router does an ARP broadcast.

Yes, if you use the "clear arp cache" command, it will remove all cached entries immediately and will rebuild the cache.  This will make the change immediate.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
mikebernhardtCommented:
You can have multiple IPs mapped to a single MAC address. You CANNOT have 1 IP mapped to multiple MAC addresses. You may be seeing arps for the old address because hosts cache DNS info. If hosta thinks that servera.domain.com is 192.168.1.15 and then you change it to 192.168.1.20, then hosta still thinks that servera is at 192.168.1.15 until it's rebooted or you flush the DNS cache on hosta.

The router can have mutliple IPs on a single MAC, no problem. It wouldn't arp for the old address unless someone was asking for it, such as hosta in the previous example. If you clear the arp cache, it will clear the router table. But hosta may still ask for it and the router will try again. You would see "Incomplete" in the arp table.
0
lrmooreCommented:
Absolutely, you have an arp cache that will "hold on" to the old mapping for a period of time, as well as other systems around you will also have arp cache and dns cache and Netbios name caches.

See this Question, too, where we had the issue of changing out firewalls. New MAC address, same IP address, and the router cache had to be cleared:
http://www.experts-exchange.com/Security/Firewalls/Q_21197865.html

Default arp cache on a Cisco router is something like 4 hours..
0
dissolvedAuthor Commented:
Thanks fellas
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.