ARP(8)

✨ NAME ✨

okay bestie, welcome to the arp manual (it's section 8, the sysadmin corner 💅) 🎀

arp - manipulate the system ARP cache

💜 SYNOPSIS 💜

arp [-vn] [-H type] [-i if] [-ae] [hostname]

arp [-v] [-i if] -d hostname [pub]

arp [-v] [-H type] [-i if] -s hostname hw_addr [temp]

arp [-v] [-H type] [-i if] -s hostname hw_addr [netmask nm] pub

arp [-v] [-H type] [-i if] -Ds hostname ifname [netmask nm] pub

arp [-vnD] [-H type] [-i if] -f [filename]

🦋 DESCRIPTION 🦋

so arp is the tool that pokes at the kernel's IPv4 network neighbour cache 🧚 It can add entries to the table, delete one, or just show you what's currently in there.

ARP stands for Address Resolution Protocol, and it's how your machine finds the media access control address of a network neighbour when it only knows the IPv4 address. iykyk 🌸

🌈 MODES 🌈

so with no mode specifier, arp just prints the current table. You can narrow that down by giving it a hardware address type, an interface name, or a host address, so you don't have to scroll through everything 👑

arp -d address deletes an ARP table entry. You need root or netadmin privilege for this, no cap 🔥 The entry gets found by its IP address. If you give it a hostname, that gets resolved first, and then the entry is looked up in the ARP table.

arp -s address hw_addr sets up a brand new table entry. The format of hw_addr depends on the hardware class, but for most classes you can assume the usual presentation works. For the Ethernet class that's 6 bytes in hexadecimal, separated by colons. When you add proxy arp entries (the ones with the publish flag set), you can specify a netmask to proxy arp for entire subnets. Fair warning: this is not good practice 🙈 but older kernels support it because it can be useful. If you don't supply the temp flag, the entry gets permanently stored in the ARP cache. And if you want to set up an entry for one of your own network interfaces, the arp -Ds address ifname form is the bestie move, since the hardware address gets taken straight from the interface with that name ✨

💅 OPTIONS 💅

• -v, --verbose — tells you what's going on by being verbose 🗣️
• -n, --numeric — shows numerical addresses instead of trying to figure out symbolic host, port or user names 🔢
• -H type, --hw-type type, -t type — when you're setting or reading the ARP cache, this optional parameter tells arp which class of entries to check for. The default is ether (aka hardware code 0x01 for IEEE 802.3 10Mbps Ethernet). Other options include network tech like ARCnet (arcnet), PROnet (pronet), AX.25 (ax25) and NET/ROM (netrom) 🎀
• -a — uses the alternate BSD style output format, with no fixed columns 🍓
• -e — uses the default Linux style output format, with fixed columns 💜
• -D, --use-device — instead of a hw_addr, the argument you give is the name of an interface. arp will use that interface's MAC address for the table entry. This is usually the best option for setting up a proxy ARP entry pointing at yourself 🦋
• -i If, --device If — selects an interface. When dumping the cache, only entries matching that interface get printed. When setting a permanent or temp entry, the entry gets associated with this interface. If you don't use this option, the kernel guesses based on the routing table. For pub entries, the interface you name is the one where ARP requests get answered 🌈

NOTE: this has to be different from the interface the IP datagrams will be routed to.

NOTE: as of kernel 2.2.0 it is no longer possible to set an ARP entry for an entire subnet 💀 Linux instead does automagic proxy arp when a route exists and it's forwarding. See arp(7) for the tea. Also, the dontpub option (available for delete and set operations) cannot be used with 2.4 and newer kernels.

• -f filename, --file filename — similar to -s, except this time the address info comes from the file filename. Super useful if you've got ARP entries for a whole lot of hosts to set up 🧚 The data file is very often /etc/ethers, but that's not official. If you don't specify a filename, /etc/ethers is used by default.

The file format is simple: it's just ASCII text lines with a hostname and a hardware address separated by whitespace. You can also use the pub, temp and netmask flags in there 🫶

In every spot where a hostname is expected, you can also enter an IP address in dotted-decimal notation, no stress 💖

As a special case for compatibility, the order of the hostname and the hardware address can be swapped. Wild, I know 🙈

Every complete entry in the ARP cache gets marked with the C flag. Permanent entries are marked with M, and published entries have the P flag ✨

🍓 EXAMPLES 🍓

/usr/sbin/arp -i eth0 -Ds 10.0.0.2 eth1 pub

This answers ARP requests for 10.0.0.2 on eth0 with the MAC address for eth1 🦋

/usr/sbin/arp -i eth1 -d 10.0.0.1

Deletes the ARP table entry for 10.0.0.1 on interface eth1. This will match published proxy ARP entries and permanent entries too 💅

🗂️ FILES 🗂️

• /proc/net/arp
• /etc/networks
• /etc/hosts
• /etc/ethers

🔗 SEE ALSO 🔗

ethers(5), rarp(8), route(8), ifconfig(8), netstat(8) 💜

👑 AUTHORS 👑

Fred N. van Kempen <waltje@uwalt.nl.mugnet.org>, Bernd Eckenfels <net-tools@lina.inka.de> 🫶

---

that's the whole tea, bestie 💖 it's from net-tools, dated 2008-10-03, and you're literally a whole ARP pro now 🦋✨