Skip to main content

ARP

Basic ARP Command Usage in Linux

The arp command is a network utility tool that comes pre-installed in most Linux distributions. Its primary function is to manage the ARP cache, which is a temporary storage for IP to MAC address mappings. These mappings are crucial for network communications.

Let’s look at the most basic usage of the arp command. The -a option is used to display the ARP cache.

arp -a

# Output:
# (192.168.1.1) at ab:cd:ef:gh:ij:kl [ether] on eth0

In this example, arp -a displays the entire ARP cache. The output shows the IP address (192.168.1.1), the corresponding MAC address (ab:cd:ef:gh:ij:kl), and the network interface (eth0) on which the ARP entry is located.

This basic use of the arp command is beneficial for quickly viewing the current state of the ARP cache. It can help you spot any irregularities or potential issues in your network communications.

However, it’s important to note that the ARP cache is dynamic and changes over time. Entries that are not used frequently may be removed automatically. Therefore, the output of arp -a may vary each time you run it, reflecting the current state of network communications.

In the next section, we’ll delve into more advanced uses of the arp command in Linux.

Advanced ARP Command Usage in Linux

As you become more comfortable with the basic usage of the arp command, you can start to explore its more advanced features. These include adding, removing, or modifying entries in the ARP cache, providing you with greater control over your network communications.

Before we dive into these advanced use cases, let’s familiarize ourselves with some of the command-line arguments or flags that can modify the behavior of the arp command. Here’s a table with some of the most commonly used arp arguments.

Argument Description Example
-a Show all entries in the ARP cache. arp -a
-d Delete an entry in the ARP cache. arp -d 192.168.1.1
-s Add a new entry to the ARP cache. arp -s 192.168.1.1 ab:cd:ef:gh:ij:kl
-v Enable verbose mode. arp -v -a
-n Do not resolve names. arp -n -a
-i Specify the network interface. arp -i eth0 -a
-D Read hardware address from given device. arp -D eth0 -s 192.168.1.1
-e Display in default (Linux) style. arp -e -a
-H Specify the hardware type. arp -H ether -a
-p Publish the entry. arp -s 192.168.1.1 ab:cd:ef:gh:ij:kl -p
-r Read new entries from file or standard input. arp -r < arp_entries.txt
-t Specify the hardware type. arp -t ether -a

Now that we have a basic understanding of arp command line arguments, let’s dive deeper into the advanced use of the arp command in Linux.

Adding an Entry to the ARP Cache

You can add a new entry to the ARP cache using the -s flag. This can be useful in certain network troubleshooting or testing scenarios.

arp -s 192.168.1.2 ab:cd:ef:gh:ij:kl

# Output:
# ARP entry added for 192.168.1.2

In this example, we add a new entry to the ARP cache for the IP address 192.168.1.2 with the MAC address ab:cd:ef:gh:ij:kl.

Deleting an Entry from the ARP Cache

You can remove an entry from the ARP cache using the -d flag. This can be helpful if an entry in the ARP cache is causing network issues.

arp -d 192.168.1.2

# Output:
# ARP entry removed for 192.168.1.2

In this example, we delete the ARP cache entry for the IP address 192.168.1.2.

Modifying an Entry in the ARP Cache

You can modify an existing entry in the ARP cache by first deleting the entry using the -d flag, then adding a new entry with the updated information using the -s flag.

arp -d 192.168.1.2
arp -s 192.168.1.2 12:34:56:78:9a:bc

# Output:
# ARP entry removed for 192.168.1.2
# ARP entry added for 192.168.1.2

In this example, we first delete the ARP cache entry for the IP address 192.168.1.2. Then we add a new entry for the same IP address, but with a different MAC address (12:34:56:78:9a:bc).

These are just a few examples of the advanced uses of the arp command in Linux. Remember, understanding and effectively utilizing the arp command can significantly enhance your network management capabilities in a Linux system.

Exploring Alternative Commands: IP Neighbour

While the arp command is a powerful tool for managing the ARP cache in Linux, there are alternative commands and functions that can accomplish similar tasks. One such command is ip neighbour, a part of the iproute2 package that comes pre-installed in most Linux distributions.

Understanding IP Neighbour

The ip neighbour command is used to manage and display entries in the neighbour table (ARP cache) in a Linux system. It has a similar function to the arp command but offers a more modern and flexible interface.

Here’s an example of how to display the neighbour table using ip neighbour:

ip neighbour show

# Output:
# 192.168.1.1 dev eth0 lladdr ab:cd:ef:gh:ij:kl REACHABLE

In this example, ip neighbour show displays the entire neighbour table. The output shows the IP address (192.168.1.1), the network interface (eth0), the corresponding MAC address (ab:cd:ef:gh:ij:kl), and the state of the entry (REACHABLE).

Adding and Removing Entries with IP Neighbour

You can also add and remove entries in the neighbour table using ip neighbour. Here’s an example of how to add a new entry:

ip neighbour add 192.168.1.2 lladdr 12:34:56:78:9a:bc dev eth0

# Output:
# Neighbour entry added for 192.168.1.2

And here’s an example of how to remove an entry:

ip neighbour del 192.168.1.2 dev eth0

# Output:
# Neighbour entry removed for 192.168.1.2
Back to top