The arp command in Linux is used to display and modify the Address Resolution Protocol (ARP) cache. ARP is a protocol that is used to map the IP addresses of network devices to their physical (hardware) addresses, such as their MAC address.
The ARP cache is a table that stores the mapping of IP addresses to physical addresses so that the system can quickly look up the physical address of a device when it needs to communicate with it.
- Using The arp Command
- Examples of The Arp Command
- Display the contents of the ARP cache
- Delete an IP Address
- Add a New Entry to the ARP Cache
- Display the IP addresses and Physical Addresses in Numeric Form
- Add a New Entry To The Arp Cache By Reading it From a File
- Display the ARP cache entries for a Specified Network Interface
- Delete all Entries from Arp Cache
- Other Examples:
Using The arp Command
To use the arp command, you must first open a terminal window on your Linux system. From there, you can use the following commands:
- arp -a: This command displays the contents of the ARP cache, showing the mapping of IP addresses to physical addresses.
- arp -d <IP address>: This command deletes the specified IP address from the ARP cache.
- arp -s <IP address> <physical address> [<interface>]: This command adds a new entry to the ARP cache, mapping the specified IP address to the specified physical address. The optional <interface> parameter can be used to specify the network interface that the mapping applies to.
- arp -v: This command enables verbose output, which will display additional information about the progress of the operation.
The arp command also provides some additional options that you can use to modify the behavior of the command. For example, you can use the -n flag to display the IP addresses and physical addresses in numeric form, rather than resolving them to hostnames and device names. You can view the full list of available options by using the man command to view the arp manual.
Examples of The Arp Command
Here are some examples of using the arp command in Linux:
Display the contents of the ARP cache
To display the contents of the ARP cache, you would use the following command:
arp -a
Delete an IP Address
To delete the IP address "192.168.1.5" from the ARP cache, you would use the following command:
arp -d 192.168.1.5
Add a New Entry to the ARP Cache
To add a new entry to the ARP cache that maps the IP address "192.168.1.5" to the physical address "00:11:22:33:44:55", you would use the following command:
arp -s 192.168.1.5 00:11:22:33:44:55
Display the IP addresses and Physical Addresses in Numeric Form
To display the IP addresses and physical addresses in numeric form, rather than resolving them to hostnames and device names, you would use the -n flag, like this:
arp -n -a
Add a New Entry To The Arp Cache By Reading it From a File
The below command reads the specified file and adds the entries in the file to the ARP cache. The file should contain one entry per line, in the format <IP address> <physical address> [<interface>].
arp -f <filename>
Display the ARP cache entries for a Specified Network Interface
The below command displays the ARP cache entries for the specified network interface.
arp -n -i <interface>
Delete all Entries from Arp Cache
This command deletes all entries from the ARP cache.
arp -n -d
Other Examples:
The below command displays the entries in the ARP cache that have been marked as "permanent", meaning that they will not be automatically removed from the cache.
arp -n -p
The below command displays the entries in the ARP cache that have a time stamp associated with them. The time stamp indicates how long ago the entry was last used.
arp -n -t
These examples demonstrate some of the more advanced features of the arp command. You can use these commands and options to perform more complex operations on the ARP cache on your Linux system.