Explore the Network Address Table Using ARP

The arp command displays and manipulates the network address table on a local UNIX system.With the arp command, the system administrator can

  • Display the ARP cache
  • Delete an ARP entry
  • Add an ARP entry


Displaying the ARP Cache

To display the contents of the ARP table, use the arp -v command. When the table is displayed, it includes the device name, hardware type, physical address, mask flag, and network interface.

  • -a Displays the current ARP entry for a specific host (Linux only). Displays
  • all of the entries within the ARP table (Solaris and HP-UX).
  • -d Deletes an ARP entry specified after this option.
  • -f Loads a file that contains entries to place in the cache.
  • -i Displays only those entries for specified interface (Linux only).
  • -n Shows numerical addresses instead of hostnames (Linux only).
  • -s Creates an ARP entry.
  • -v Displays ARP cache using verbose mode (Linux only).

Deleting an ARP Cache

It might become necessary to delete one or more entries from the ARP table. For example, should a hardware failure result in the replacement of a network interface card, the network hardware address of the system will change. In this case, the existing ARP entry won’t reflect that the low-level address has changed.

To address this, the -d option should be used to delete an ARP entry. The arp command expects the -d option to be used with a valid host or IP address. In this example for Linux, the host durer is removed from the ARP table:

# arp -d durer

Adding an ARP Cache Entry
Several conditions may warrant manually adding entries to the ARP table. One such situation occurs when communication with a device is needed, but the device for some reason doesn’t support ARP, or the implementation is nonfunctional. This might be the case with a very old system that is still in service. Further, should a NIC address change, the table must be manually updated to ensure connectivity. Finally, it may be necessary to add entries to support proxy ARP services.

To add an ARP entry, use the -s option followed by the hostname (or address) and the associated physical data link address. For example, let’s say we would like to add a system called bruegel to the ARP table. The format of the physical data link is represented by 6 bytes separated by colons (:) where each byte is a hexadecimal number between 0 and FF. To illustrate an example, the following command could be used:

# arp -s bruegel 08:00:20:82:be:05