ARPD(8)

🎀 ARPD(8) 🎀

System Manager's Manual ✨

💖 NAME 💖

arpd - userspace arp daemon. 🦋

🧚 SYNOPSIS 🧚

Usage: arpd [ -lkh? ] [ -a N ] [ -b dbase ] [ -B number ] [ -f file ]
[-p interval ] [ -n time ] [ -R rate ] [ <INTERFACES> ]

🌸 DESCRIPTION 🌸

okay so the arpd daemon is literally a collector bestie 💅 It gathers gratuitous ARP information and saves it to local disk, then feeds it back to the kernel whenever it's asked. Why? Because the kernel's ARP cache is pretty small, and this stops it from having to shout into the void with redundant broadcasts over and over. Lowkey genius. ✨

💜 OPTIONS 💜

• -h, -? — Print help. Your lifeline when you forget everything 🙈
• -l — Dump the arpd database to stdout and then exit. The output has three columns: the interface index, the IP address of the interface, and the MAC address of the interface. Negative entries for dead hosts show up too 💀 For those, the MAC address gets swapped out for the word FAILED, then a colon, then the most recent time when the host was proven to be dead.
• -f <FILE> — Read and load an arpd database from FILE, which is a text format similar to what -l dumps. It exits after loading, and if -l is also given it'll list the resulting database first. If FILE is -, stdin gets read instead to grab the ARP table 🫶
• -b <DATABASE> — The location of the database file. The default spot is /var/lib/arpd/arpd.db 🍓
• -a <NUMBER> — With this option, arpd doesn't just passively listen for ARP packets on the interface, it also sends broadcast queries itself. NUMBER is how many of those queries to make before a destination is considered dead. Now the tea: if arpd is started as a kernel helper (like with app_solicit enabled in sysctl or even with -k) and you skip this option, and it still hasn't learned enough info, you might see 1 second gaps in service. Not fatal, but not good 😭
• -k — Suppress sending broadcast queries by the kernel. This one only makes sense alongside -a. 🔥
• -n <TIME> — Sets the timeout of the negative cache. When resolution fails, arpd stops trying to resolve that same destination for this period. This only makes sense together with -k. The timeout shouldn't be way longer than the boot time of a typical host that doesn't support gratuitous ARP. The default is 60 seconds ⏰
• -p <TIME> — How long to wait, in seconds, between polling attempts to the kernel ARP table. TIME can be a floating point number. The default is 30 ✨
• -R <RATE> — The maximal steady rate of broadcasts arpd sends, in packets per second. The default is 1 🦋
• -B <NUMBER> — The number of broadcasts arpd sends back to back. The default is 3. Together with -R, this keeps the number of broadcast ARP queries from going over B+R*T in any interval of time T. Strict but fair 💅

INTERFACES is a list of names of networking interfaces to watch. If you don't give any, arpd monitors all of them. In that case arpd does not adjust sysctl parameters, so it's assumed you'll do that yourself after arpd starts 🧚

🌈 SIGNALS 🌈

⚠️ Only SIGINT and SIGTERM (graceful exit), SIGHUP (sync), and SIGUSR1 (stats) have defined behavior here. Any other signal is undefined and may corrupt the database and leave the sysctl parameters in an unpredictable state. Not it. 💀

When arpd gets a SIGINT or SIGTERM, it exits gracefully, syncing the database and restoring the adjusted sysctl parameters. On a SIGHUP, it syncs the database to disk. With SIGUSR1, it sends some statistics to syslog. The effect of any other signals is undefined. In particular, they may corrupt the database and leave the sysctl parameters in an unpredictable state.

🎀 NOTE 🎀

So for arpd to work as an ARP resolver, the kernel has to be compiled with the option CONFIG_ARPD. Also, if the interface list isn't given on the command line, the variable app_solicit on the interfaces you care about should be in /proc/sys/net/ipv4/neigh/*. If that isn't set up, arpd still collects gratuitous ARP information in its database, so it's not a total loss 🫶

🍓 EXAMPLES 🍓

arpd -b /var/tmp/arpd.db

Start arpd to collect gratuitous ARP, without messing with kernel functionality. Chill mode 🧘

killall arpd ; arpd -l -b /var/tmp/arpd.db

Look at the result after some time. Patience, bestie ⏳

arpd -b /var/tmp/arpd.db -a 1 eth0 eth1

Enable the kernel helper and leave the leading role to the kernel 👑

arpd -b /var/tmp/arpd.db -a 3 -k eth0 eth1

Completely replace kernel resolution on interfaces eth0 and eth1. In this case the kernel still does unicast probing to validate entries, but all the broadcast activity is suppressed and handled under the authority of arpd. Main character energy 💜

This is the mode in which arpd normally is supposed to work. It is not the default, to prevent occasional enabling of too aggressive a mode. Safety first, periodt 💅

okay that's the whole tea, bestie 🫶 ARPD(8) was last updated on 28 June, 2007, and it's giving System Manager's Manual vibes all the way through ✨🦋🌈