highAdvancedUSE#arp#neighbor#cache#table-overflow#ndisc

ARP cache incomplete or full -- neighbor table overflow, 'no route to host' locally

'No route to host' errors between hosts on the same subnet

Likely source:connectivityscaling

Focused incident mode — strips away everything but this runbook.

Symptoms

  • 'No route to host' errors between hosts on the same subnet
  • ip neigh show shows entries in STALE or INCOMPLETE state
  • arp -a or ip neigh shows an unusually high number of entries

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Neighbor table state

    ip neigh show | grep -E 'INCOMPLETE|FAILED|STALE' | head -20

  • Neighbor table size

    ip neigh show | wc -l && sysctl net.ipv4.neigh.default.gc_thresh1

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • ip neigh show count approaches gc_thresh3 (1024)
  • 'No route to host' on the same L2 segment

Confirm before fixing

ip neigh show | wc -l
READ

Count total neighbor entries

Fix

sysctl -w net.ipv4.neigh.default.gc_thresh1=512 && sysctl -w net.ipv4.neigh.default.gc_thresh2=1024 && sysctl -w net.ipv4.neigh.default.gc_thresh3=2048
CHANGE

Raise the ARP table GC thresholds

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
ip neigh show | wc -l
READ

Count total neighbor table entries

2
sysctl net.ipv4.neigh.default.gc_thresh3
READ

Read the maximum table size

3
ip neigh show | grep -E 'INCOMPLETE|FAILED' | head -20
READ

Find unresolved entries

4
sysctl -w net.ipv4.neigh.default.gc_thresh3=2048
CHANGE

Increase the table size limit

Prevention

  • Set gc_thresh values based on the number of hosts on each L2 segment.
  • Segment large broadcast domains into VLANs to limit ARP table size.
  • Monitor ARP table size with node_exporter or a custom script.
  • Avoid placing more than 500 hosts on a single broadcast domain.

Related runbooks

Same stack, same failure family — worth a skim.

IPv6 network unreachable -- IPv6 disabled or broken, app binds IPv6 onlyhigh

'connect: Network is unreachable' when the app tries to connect via IPv6

NetworkingIntermediate4 causes
Open runbook
PMTU blackhole -- large packets silently dropped due to Path MTU Discovery failurehigh

Small HTTP requests succeed but large responses or file transfers hang or fail

NetworkingAdvanced3 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.