If an event is detected before the entry’s reachable lifetime expires, then the reachable lifetime is reset. To qualify for the REACHABLE state, a new entry goes through the process illustrated in the figure below. The switch detects an event (E), such as an incoming control packet from a connected host and creates an entry. Various events cause the creation of an entry, and these are described in the Binding Table Sources section. The creation of an entry is followed by different transient states, such as TENTATIVE or INCOMPLETE. While in a transitional state, the switch validates and confirms the integrity of the binding entry.
If the entry is found to be valid, then the state changes to REACHABLE. But if an address theft or similar event is detected, then the entry is regarded as invalid and is deleted. For example, if an attacker sends unsolicited neighbor advertisement messages with the same IP as the target IP and its (attacker's) own MAC address to redirect traffic. Figure 3: Creation of a Reachable Entry State: Stale If an entry is in this state it means that the entry’s reachable lifetime has expired and the corresponding host is still silent (no incoming packets from the host). A stale entry has a default lifetime of 24 hours. You can also configure a duration.
An entry that remains in the STALE state beyond the stale lifetime, is deleted. This is illustrated in the figure below which depicts the lifecycle of an entry. Figure 4: Lifecycle of an Entry State: Down If an entry is in this state, it means that the host’s connecting interface is down. A down entry has a default lifetime of 24 hours. You can also configure a duration. An entry that remains in the DOWN state beyond the down lifetime, is deleted. Polling a Host and Updating the Binding Table Entry Polling is a periodic and conditional checking of the host to see the state it is in, whether it is still connected, and whether it is communicating.
In addition to determining an entry’s state, you can use polling to reconfirm an entry's state. Configuring Switch Integrated Security Features States and Lifetime of a Binding Table Entry Configuring Switch Integrated Security Features 4