Understanding Linux Network Internals

Neighbor Deletion

A neighbour data structure can be removed for three main reasons:

• The kernel tries to send a packet to a host that is not reachable. There are many reasons this could happen: the host went down, its cable came unplugged, it was a wireless device that moved out of range, its network configuration got corrupted, or somebody manually created an entry for a nonexistent host. Whatever the cause, the neighboring subsystem notices the failure and puts the associated neighbour structure into the NUD_FAILED state so that it is cleaned up by asynchronous garbage collection, described in the section "Asynchronous cleanup: the neigh_periodic_timer function ."

• The host associated with the neighbor structure has changed its L2 address (perhaps because its NIC was replaced) but still has the same L3 configuration. Thus, the neighbour structure has an outdated L2 address. A host with an outdated neighbor entry has to put it into the NUD_FAILED state and create a new one.^[*]

• The structure gets old and the kernel needs its memory. It is therefore removed by garbage collection, described in the section "Synchronous cleanup: the neigh_forced_gc function."

The transition to NUD_FAILED is taken care of by the NUD algorithm introduced in the section "Transitions Between NUD States" in Chapter 26. Asynchronous garbage collection is performed by the neigh_periodic_timer function, which is associated with the neigh_table->gc_timer timer (see the sections "Timers" and "Garbage Collection" for ...