ARP caches do time out. So it may be the case that the entry was still used/valid less then the time out minutes ago. IIRC the time out is something in the order of 15-30 minutes. May be that is configurable, but I do not know how. I also think that lowering this value will have a negative impact on normal LAN performance. There is a possibility in arp to send a package that an entry should be dropped, but I do not know if all implementations do react on this. See: Address Resolution Protocol - Wikipedia, the free encyclopedia