Calculate ARP cache size and expiration behavior based on neighbor table thresholds.
The ARP (or IPv6 neighbor discovery) cache maps IP addresses to MAC addresses for hosts on the same local subnet, growing roughly in proportion to the number of distinct neighbors a host has actually communicated with recently, up to gc_thresh limits. Entries age out after gc_stale_time seconds of inactivity (triggering a re-resolution probe on next use rather than immediate deletion), and each entry carries a small but nonzero kernel memory cost — on subnets with very high host counts (large flat L2 networks), ARP cache sizing and gc_thresh tuning become relevant to avoid table exhaustion warnings.
ARP cache entries
entries = hosts_on_subnet (bounded by neigh gc_thresh limits)
`ip neigh show` lists all current neighbor table entries with their state (REACHABLE, STALE, etc.); `cat /proc/net/arp | wc -l` gives a quick count (subtract 1 for the header row).
The kernel logs 'neighbour table overflow' and drops the oldest/least-recently-used entries to make room, which can cause brief connectivity hiccups on very large flat networks — raising `net.ipv4.neigh.default.gc_thresh1/2/3` is the standard fix for legitimately large subnets.
Marking an entry STALE (rather than deleting it outright) lets the kernel keep using the cached MAC address optimistically while probing to confirm it's still valid, avoiding a lookup stall on every single packet — only entries that fail to be confirmed and haven't been used are eventually garbage collected.