Table of Contents
- Introduction
- How to use arp command in linux
- How to use arp command with interface option (-i) in linux
- How to use Arp command with display BSD style option(-a) and display linux style option (-e) in linux
- How to use Arp command with numbered option (-n) in linux
- How to check failed arp entries in linux
- How to delete existing arp entries using Arp command with delete option(-d) in linux
- How to add static Arp entries to the table using set option (-s) in linux
- How to add temporary manual Arp entries using arp command with set and temp option
- How to create the publish entry with Arp command
Introduction
Wondering how to view the arp entries on a linux machine or use cases of arp command ?
This article covers how to use arp command to view the arp table entires on the linux machine , along with other options supported by arp command in detail.
Arp command in the linux machine is very helpful to understand the resolved arp entries or failed to resolve entries if any . This is especially used for network troubleshooting
To understand all the options which can be used along with the arp command , we can use the help option
root@DiscoveringSystems-ubuntu:/# arp -hHow to use arp command in linux
In the following setup , we tried to ping from one host to another and the ping seems to be successful , To know more about how ping and arp packets works you can take a look at the following articles
DS centos ( 192.168.94.200)------------switch---------(192.168.94.100) DS Ubuntu
[root@discoveringsystems-centos /]# ping 192.168.94.100
PING 192.168.94.100 (192.168.94.100) 56(84) bytes of data.
64 bytes from 192.168.94.100: icmp_seq=1 ttl=64 time=0.630 ms
64 bytes from 192.168.94.100: icmp_seq=2 ttl=64 time=0.255 ms
64 bytes from 192.168.94.100: icmp_seq=3 ttl=64 time=0.373 ms
64 bytes from 192.168.94.100: icmp_seq=4 ttl=64 time=0.281 ms
64 bytes from 192.168.94.100: icmp_seq=5 ttl=64 time=0.268 ms
64 bytes from 192.168.94.100: icmp_seq=6 ttl=64 time=0.294 ms
^C
--- 192.168.94.100 ping statistics ---
6 packets transmitted, 6 received, 0% packet loss, time 5002ms
rtt min/avg/max/mdev = 0.255/0.350/0.630/0.131 ms
Then after the ping works it is expected to see the arp entries resolves as without knowing the destination mac the ping would not have succeeded
To view the arp entries present on the machine you can use the following command
[root@discoveringsystems-centos /]# arp
Address HWtype HWaddress Flags Mask Iface
192.168.44.254 ether 00:50:56:f8:0e:e9 C ens37
192.168.44.1 ether 00:50:56:c0:00:08 C ens37
gateway ether 00:50:56:ee:88:ce C ens37
192.168.94.100 ether 00:0a:0a:0a:0a:0a C ens33
We also can check the other side host for the Arp entries to confirm that both sides resolved the mac needed for the ping to work
root@DiscoveringSystems-ubuntu:/# arp
Address HWtype HWaddress Flags Mask Iface
192.168.44.1 ether 00:50:56:c0:00:08 C ens33
_gateway ether 00:50:56:ee:88:ce C ens33
192.168.44.254 ether 00:50:56:f8:0e:e9 C ens33
192.168.94.200 ether 00:0b:0b:0b:0b:0b C ens38
How to use arp command with interface option (-i) in linux
If you would like to check the Arp entries for one particular interface , you can use interface option(-i) along with the arp command. The following example shows all the available arp entries learned on the interface ens38
root@DiscoveringSystems-ubuntu:/# arp -i ens38
Address HWtype HWaddress Flags Mask Iface
192.168.94.200 ether 00:0b:0b:0b:0b:0b C ens38
How to use Arp command with display BSD style option(-a) and display linux style option (-e) in linux
If we use the following options we can view the arp tables in either BSD style or linux style. Also it shows all the Arp entries, even the ones which are incomplete or failed.
-a display (all) hosts in alternative (BSD) style
-e display (all) hosts in default (Linux) style
root@DiscoveringSystems-ubuntu:/# arp -e
Address HWtype HWaddress Flags Mask Iface
192.168.44.1 ether 00:50:56:c0:00:08 C ens33
_gateway ether 00:50:56:ee:88:ce C ens33
192.168.44.254 ether 00:50:56:f8:0e:e9 C ens33
192.168.94.200 ether 00:0b:0b:0b:0b:0b C ens38
root@DiscoveringSystems-ubuntu:/# arp -a
? (192.168.44.1) at 00:50:56:c0:00:08 [ether] on ens33
_gateway (192.168.44.2) at 00:50:56:ee:88:ce [ether] on ens33
? (192.168.44.254) at 00:50:56:f8:0e:e9 [ether] on ens33
? (192.168.94.200) at 00:0b:0b:0b:0b:0b [ether] on ens38
If we add verbose option along with the BSD or linux option , you will be able to see the following
root@DiscoveringSystems-ubuntu:/# arp -ve
Address HWtype HWaddress Flags Mask Iface
192.168.44.1 ether 00:50:56:c0:00:08 C ens33
_gateway ether 00:50:56:ee:88:ce C ens33
192.168.44.254 ether 00:50:56:f8:0e:e9 C ens33
192.168.94.200 ether 00:0b:0b:0b:0b:0b C ens38
Entries: 4 Skipped: 0 Found: 4
root@DiscoveringSystems-ubuntu:/# arp -va
? (192.168.44.1) at 00:50:56:c0:00:08 [ether] on ens33
_gateway (192.168.44.2) at 00:50:56:ee:88:ce [ether] on ens33
? (192.168.44.254) at 00:50:56:f8:0e:e9 [ether] on ens33
? (192.168.94.200) at 00:0b:0b:0b:0b:0b [ether] on ens38
Entries: 4 Skipped: 0 Found: 4
How to use Arp command with numbered option (-n) in linux
Arp command with numbered option , lets us see the actual ip address in the arp tables and it doesn’t resolve any names or hostnames for the entries . This is useful when you are comfortable checking the Ip addresses directly instead of the hostnames. In the following example you will see one with numbered option (-n) and one without the numbered option to understand the difference
root@DiscoveringSystems-ubuntu:/# arp -n
Address HWtype HWaddress Flags Mask Iface
192.168.44.1 ether 00:50:56:c0:00:08 C ens33
192.168.44.2 ether 00:50:56:ee:88:ce C ens33
192.168.44.254 ether 00:50:56:f8:0e:e9 C ens33
192.168.94.200 ether 00:0b:0b:0b:0b:0b C ens38
root@DiscoveringSystems-ubuntu:/# arp
Address HWtype HWaddress Flags Mask Iface
192.168.44.1 ether 00:50:56:c0:00:08 C ens33
_gateway ether 00:50:56:ee:88:ce C ens33
192.168.44.254 ether 00:50:56:f8:0e:e9 C ens33
192.168.94.200 ether 00:0b:0b:0b:0b:0b C ens38
How to check failed arp entries in linux
If you check the following ping example , we can see that the ping didn’t succeed. So we went ahead and checked on the arp resolve entries and found that the arp is not resolved ( incomplete) . This means that either the arp response is not received or not processed by the machine we are using
root@DiscoveringSystems-ubuntu:/# ping 192.168.94.250
PING 192.168.94.250 (192.168.94.250) 56(84) bytes of data.
^C
--- 192.168.94.250 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2045ms
root@DiscoveringSystems-ubuntu:/# arp
Address HWtype HWaddress Flags Mask Iface
192.168.44.1 ether 00:50:56:c0:00:08 C ens33
_gateway ether 00:50:56:ee:88:ce C ens33
192.168.94.250 (incomplete) ens38
192.168.44.254 ether 00:50:56:f8:0e:e9 C ens33
192.168.94.200 ether 00:0b:0b:0b:0b:0b C ens38
How to delete existing arp entries using Arp command with delete option(-d) in linux
In the following example , we are deleting the ARP entry for the IP 192.168.94.200 from the ARP table using the delete option
root@DiscoveringSystems-ubuntu:/# arp -n
Address HWtype HWaddress Flags Mask Iface
192.168.44.1 ether 00:50:56:c0:00:08 C ens33
192.168.44.2 ether 00:50:56:ee:88:ce C ens33
192.168.94.250 (incomplete) ens38
192.168.44.254 ether 00:50:56:f8:0e:e9 C ens33
192.168.94.200 ether 00:0b:0b:0b:0b:0b C ens38
root@DiscoveringSystems-ubuntu:/# arp -d 192.168.94.200
root@DiscoveringSystems-ubuntu:/# arp -n
Address HWtype HWaddress Flags Mask Iface
192.168.44.1 ether 00:50:56:c0:00:08 C ens33
192.168.44.2 ether 00:50:56:ee:88:ce C ens33
192.168.94.250 (incomplete) ens38
192.168.44.254 ether 00:50:56:f8:0e:e9 C ens33
How to add static Arp entries to the table using set option (-s) in linux
In the following example , we were adding the arp entry for 192.168.94.200 using set option
Let’s also discuss about the Flags seen on the Arp table
C = these entries shows are dynamic entries or temporary entries
M = Manual addition , if it goes with C like the below example it also means a manual entry
root@DiscoveringSystems-ubuntu:/# arp -s 192.168.94.200 00:0b:0b:0b:0b:0b
root@DiscoveringSystems-ubuntu:/# arp -e
Address HWtype HWaddress Flags Mask Iface
192.168.44.1 ether 00:50:56:c0:00:08 C ens33
_gateway ether 00:50:56:ee:88:ce C ens33
192.168.94.250 (incomplete) ens38
192.168.44.254 ether 00:50:56:f8:0e:e9 C ens33
192.168.94.200 ether 00:0b:0b:0b:0b:0b CM ens38
root@DiscoveringSystems-ubuntu:/# arp -a
? (192.168.44.1) at 00:50:56:c0:00:08 [ether] on ens33
_gateway (192.168.44.2) at 00:50:56:ee:88:ce [ether] on ens33
? (192.168.94.250) at <incomplete> on ens38
? (192.168.44.254) at 00:50:56:f8:0e:e9 [ether] on ens33
? (192.168.94.200) at 00:0b:0b:0b:0b:0b [ether] PERM on ens38
How to add temporary manual Arp entries using arp command with set and temp option
In the following example , we are adding a manual entry for the 192.168.94.200 using Arp command with set option and temp option
Let’s also discuss about the Flags seen on the Arp table
C = these entries shows are dynamic entries or temporary entries , manual addition with temp option also shows just C flag
M = Manual addition
root@DiscoveringSystems-ubuntu:/# arp -s 192.168.94.200 00:0b:0b:0b:0b:0b temp
root@DiscoveringSystems-ubuntu:/# arp -a
? (192.168.44.1) at 00:50:56:c0:00:08 [ether] on ens33
_gateway (192.168.44.2) at 00:50:56:ee:88:ce [ether] on ens33
? (192.168.94.250) at <incomplete> on ens38
? (192.168.44.254) at 00:50:56:f8:0e:e9 [ether] on ens33
? (192.168.94.200) at 00:0b:0b:0b:0b:0b [ether] on ens38
root@DiscoveringSystems-ubuntu:/# arp -e
Address HWtype HWaddress Flags Mask Iface
192.168.44.1 ether 00:50:56:c0:00:08 C ens33
_gateway ether 00:50:56:ee:88:ce C ens33
192.168.94.250 (incomplete) ens38
192.168.44.254 ether 00:50:56:f8:0e:e9 C ens33
192.168.94.200 ether 00:0b:0b:0b:0b:0b C ens38
How to create the publish entry with Arp command
In the following example , we were creating the Publish entry for the 192.168.94.250
root@DiscoveringSystems-ubuntu:/# arp -H ether -i ens38 -s 192.168.94.250 00:0a:0a:0a:0a:0a pub
root@DiscoveringSystems-ubuntu:/# arp -a
? (192.168.44.1) at 00:50:56:c0:00:08 [ether] on ens33
_gateway (192.168.44.2) at 00:50:56:ee:88:ce [ether] on ens33
? (192.168.94.250) at <incomplete> on ens38
? (192.168.44.254) at 00:50:56:f8:0e:e9 [ether] on ens33
? (192.168.94.200) at 00:0b:0b:0b:0b:0b [ether] on ens38
? (192.168.94.250) at <from_interface> PERM PUB on ens38
root@DiscoveringSystems-ubuntu:/# arp -e
Address HWtype HWaddress Flags Mask Iface
192.168.44.1 ether 00:50:56:c0:00:08 C ens33
_gateway ether 00:50:56:ee:88:ce C ens33
192.168.94.250 (incomplete) ens38
192.168.44.254 ether 00:50:56:f8:0e:e9 C ens33
192.168.94.200 ether 00:0b:0b:0b:0b:0b C ens38
192.168.94.250 * <from_interface> MP ens38