Does a router keep an ARP table?

Question

How long?
Why not keep information indefinitely?

Answer 1

Yes, absolutely, the router maintains an ARP table to map IP addresses to physical (Ethernet) addresses. It must do this so it can take an IP packet (with a destination IP address) and encapsulate it in an Ethernet frame (with a destination physical address it gets from the ARP table) and send it out on the wire.

To save some communications overhead, computers and routers alike use an ARP cache to maintain a table of recently looked-up addresses. The router/computer always checks for this binding first in the ARP cache, and if it's not there, then comes the ARP request broadcast.

The typical timeout for many ARP caches is on the order of 20 minutes. Varies by vendor/platform. Why not keep it indefinitely? Because ARP maintains what is called a "soft state" that is, it's not permanent by design, because addresses can change. Suppose you change your IP address, or get a new one via DHCP, you now have the same physical address on your NIC but with a different IP address, so the ARP request/reply process will occur to update this information.

Answer 2

ARP spoofing, also known as ARP poisoning, is a technique used to attack an Ethernet network which may allow an attacker to sniff data frames on a switched local area network (LAN) or stop the traffic altogether (known as a denial of service attack).