--- title: On ARP and MAC Aging Timers « ipSpace.net blog | daily.dev description: A deep dive into the historical origins of ARP timeout (4 hours) and MAC aging timer (5 minutes) defaults used by Arista EOS and other networking platforms.... canonical: https://daily.dev/posts/on-arp-and-mac-aging-timers-ipspace-net-blog-w8c6iyyvk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: On ARP and MAC Aging Timers « ipSpace.net blog | daily.dev og:description: A deep dive into the historical origins of ARP timeout (4 hours) and MAC aging timer (5 minutes) defaults used by Arista EOS and other networking platforms.... og:url: https://daily.dev/posts/on-arp-and-mac-aging-timers-ipspace-net-blog-w8c6iyyvk og:image: https://api.daily.dev/og/posts/w8c6iyyvK.png og:image:alt: On ARP and MAC Aging Timers « ipSpace.net blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # On ARP and MAC Aging Timers « ipSpace.net blog **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 3 min read · 0 upvotes · 0 comments ## Summary A deep dive into the historical origins of ARP timeout (4 hours) and MAC aging timer (5 minutes) defaults used by Arista EOS and other networking platforms. ARP's long timeout stems from its role as a layer-mapping mechanism rather than packet-forwarding infrastructure, designed in an era when broadcasts were expensive and addresses were stable. MAC aging's short 5-minute timer exists to keep the MAC address table clean and avoid stale entries causing misdirected unicast frames — likely chosen to be shorter than the time it takes to physically move a workstation. The post also touches on how EVPN changed the MAC learning landscape by introducing a control plane, and includes a humorous anecdote about an AI hallucinating a 'half-workday heuristic' explanation for the 4-hour ARP timer. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is the default ARP timeout 4 hours on platforms like Arista EOS? The 4-hour ARP timeout originates from the early days of networking when broadcasts were expensive — every ARP broadcast consumed CPU cycles on every host sharing a thick coax cable. ARP creates a mapping between layers, not a forwarding path, and since IP and MAC addresses are generally stable, long-lived entries are safe. Gratuitous ARP handles the edge cases when addresses change, making ARP aging primarily a garbage collection mechanism. _Network engineers debating timer tuning for EVPN or large L2 domains find the tradeoffs discussed on daily.dev._ ### Why is the MAC address table aging timer set to 5 minutes by default on most switches? The 5-minute MAC aging timer is a compromise designed to keep the MAC address table clean without causing excessive unknown unicast flooding. Unlike ARP, transparent bridging had no control plane to authoritatively track MAC locations, so stale entries risked forwarding frames in the wrong direction. The 5-minute value is believed to be shorter than the time it takes to physically disconnect a workstation, move it, and reconnect it elsewhere. _Keeping up with L2 forwarding behavior and EVPN design decisions is easier when networking discussions surface on daily.dev._ ## Similar posts on daily.dev - [Your router still depends on a 44-year-old protocol to locate every device on your network](https://daily.dev/posts/your-router-still-depends-on-a-44-year-old-protocol-to-locate-every-device-on-your-network-imka9mnej) · XDA Developers · 0 upvotes · 0 comments - [When ARP Goes Wrong: Threat Hunting ARP Poisoning in Network Traffic](https://daily.dev/posts/when-arp-goes-wrong-threat-hunting-arp-poisoning-in-network-traffic-cr9xr7c4h) · InfoSec Write-ups · 1 upvotes · 0 comments - [The world in which IPv6 was a good design](https://daily.dev/posts/the-world-in-which-ipv6-was-a-good-design-tj3i8ov0s) · Hacker News · 0 upvotes · 0 comments - [Crazy Delay: IOS XR OSPFv2 Default Route Origination « ipSpace.net blog](https://daily.dev/posts/crazy-delay-ios-xr-ospfv2-default-route-origination-ipspace-net-blog-t8dnomhiq) · ipSpace.net Blog · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/on-arp-and-mac-aging-timers-ipspace-net-blog-w8c6iyyvk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"On ARP and MAC Aging Timers « ipSpace.net blog","url":"https://daily.dev/posts/on-arp-and-mac-aging-timers-ipspace-net-blog-w8c6iyyvk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/on-arp-and-mac-aging-timers-ipspace-net-blog-w8c6iyyvk"},"datePublished":"2026-08-11T08:54:33.250Z","dateModified":"2026-08-11T09:24:27.538Z","description":"A deep dive into the historical origins of ARP timeout (4 hours) and MAC aging timer (5 minutes) defaults used by Arista EOS and other networking platforms....","image":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","thumbnailUrl":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/on-arp-and-mac-aging-timers-ipspace-net-blog-w8c6iyyvk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"On ARP and MAC Aging Timers « ipSpace.net blog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/on-arp-and-mac-aging-timers-ipspace-net-blog-w8c6iyyvk#faq","mainEntity":[{"@type":"Question","name":"Why is the default ARP timeout 4 hours on platforms like Arista EOS?","acceptedAnswer":{"@type":"Answer","text":"The 4-hour ARP timeout originates from the early days of networking when broadcasts were expensive — every ARP broadcast consumed CPU cycles on every host sharing a thick coax cable. ARP creates a mapping between layers, not a forwarding path, and since IP and MAC addresses are generally stable, long-lived entries are safe. Gratuitous ARP handles the edge cases when addresses change, making ARP aging primarily a garbage collection mechanism. Network engineers debating timer tuning for EVPN or large L2 domains find the tradeoffs discussed on daily.dev."}},{"@type":"Question","name":"Why is the MAC address table aging timer set to 5 minutes by default on most switches?","acceptedAnswer":{"@type":"Answer","text":"The 5-minute MAC aging timer is a compromise designed to keep the MAC address table clean without causing excessive unknown unicast flooding. Unlike ARP, transparent bridging had no control plane to authoritatively track MAC locations, so stale entries risked forwarding frames in the wrong direction. The 5-minute value is believed to be shorter than the time it takes to physically disconnect a workstation, move it, and reconnect it elsewhere. Keeping up with L2 forwarding behavior and EVPN design decisions is easier when networking discussions surface on daily.dev."}}]} ```