如果内核在locktime时间内接收到多个ARP报文，仅首个报文生效。对于arp协议，内核默认的locktime时长为1秒钟，可通过PROC文件或者ip命令进行修改。

struct neigh_table arp_tbl = { .family = AF_INET, .key_len = 4, .protocol = cpu_to_be16(ETH_P_IP), .hash = arp_hash, .key_eq = arp_key_eq, .constructor = arp_constructor, .proxy_redo = parp_redo, .id = "arp_cache", .parms = { .tbl = &arp_tbl, .reachable_time = 30 * HZ, .data = { ... [NEIGH_VAR_LOCKTIME] = 1 * HZ, 

通过PROC文件locktime可查看和修改此值，如下，默认为100，对应于1秒钟。

讯享网$ cat /proc/sys/net/ipv4/neigh/eth0/locktime 100 

内核中静态变量neigh_sysctl_table定义了locktime的PROC文件信息。

static struct neigh_sysctl_table { struct ctl_table_header *sysctl_header; struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1]; } neigh_sysctl_template __read_mostly = { .neigh_vars = { ... NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"), 

如下定义，locktime的处理有neigh_proc_dointvec_userhz_jiffies，其负责将内核使用的jiffies值转换为用户层面的HZ（值为100），即内核locktime初始化为1000，用户层面显示为100。

讯享网#define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \ NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies) 

netlink接口

除了以上的PROC文件外，还可使用ip ntable命令查看和修改设备的邻居表参数。

# ip ntable show dev eth0 inet arp_cache dev eth0 refcnt 12 reachable 28884 base_reachable 30000 retrans 1000 gc_stale 60000 delay_probe 5000 queue 31 app_probes 0 ucast_probes 3 mcast_probes 3 anycast_delay 1000 proxy_delay 800 proxy_queue 64 locktime 1000 

与PROC文件不同，这里显示的locktime单位为毫秒值。如下将设备eth0的邻居表参数locktime修改为2秒钟。

讯享网# ip ntable change name arp_cache dev eth0 base_reachable 2000 

内核函数neigh_init初始化了以上ip ntable change命令的处理函数neightbl_set。

讯享网

static int __init neigh_init(void) { ... rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, 0); 

如下为neightbl_set的实现，函数nla_get_msecs读取IP命令行设置的locktime的毫秒值参数，转换为内核使用的jiffies值，设置到邻居表的参数中。对于arp协议，将设置到arp_tbl成员parms的子成员data数组中，索引位置为NEIGH_VAR_LOCKTIME。

讯享网static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh, struct netlink_ext_ack *extack) { struct neigh_table *tbl; struct nlattr *tb[NDTA_MAX+1]; if (tb[NDTA_PARMS]) { struct neigh_parms *p; p = lookup_neigh_parms(tbl, net, ifindex); ... for (i = 1; i <= NDTPA_MAX; i++) { switch (i) { ... case NDTPA_LOCKTIME: NEIGH_VAR_SET(p, LOCKTIME, nla_get_msecs(tbp[i])); 

显示命令ip ntable show由内核中的函数neightbl_fill_parms填充值，对于locktime的值，由nla_put_msecs填充。

static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms) { ... if ((parms->dev && ... nla_put_msecs(skb, NDTPA_LOCKTIME, NEIGH_VAR(parms, LOCKTIME), NDTPA_PAD) 

如下函数nla_put_msecs，其需要将内核使用locktime的jiffies值转换为ip ntable show显示时的毫秒值，通过jiffies_to_msecs实现。

讯享网static inline int nla_put_msecs(struct sk_buff *skb, int attrtype, unsigned long njiffies, int padattr) { u64 tmp = jiffies_to_msecs(njiffies); return nla_put_64bit(skb, attrtype, sizeof(u64), &tmp, padattr); } 

locktime处理

在arp报文处理函数arp_process中，对于连续（back-to-back）接收到的ARP回复，内核选择使用首个回复报文，因为，如果链路上存在多个活动的ARP代理，这样就选择了其中速度较快的一个，也可屏蔽一些无用的ARP回复。

内核判断连续报文的依据为locktime时长，在此段时间内接收到的ARP报文，进行更新时不设置覆盖标志位NEIGH_UPDATE_F_OVERRIDE（garp的情况除外）。

static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb) { ... /* Update our ARP tables */ n = __neigh_lookup(&arp_tbl, &sip, dev, 0); ... if (n) { int state = NUD_REACHABLE; int override; /* If several different ARP replies follows back-to-back, use the FIRST one. It is possible, if several proxy agents are active. Taking the first reply prevents arp trashing and chooses the fastest router. */ override = time_after(jiffies, n->updated + NEIGH_VAR(n->parms, LOCKTIME)) || is_garp; /* Broadcast replies and request packets do not assert neighbour reachability. */ if (arp->ar_op != htons(ARPOP_REPLY) || skb->pkt_type != PACKET_HOST) state = NUD_STALE; neigh_update(n, sha, state, override ? NEIGH_UPDATE_F_OVERRIDE : 0, 0); 

内核版本 5.0