Linux ARP Command for LAN Cache Inspection

This article provides an overview of the arp command in the Linux operating system, focusing on its role in viewing and managing the local Address Resolution Protocol (ARP) cache. It explains how the ARP cache maps network-layer addresses to link-layer physical addresses, details standard syntax and options for inspecting this table, and highlights its significance in diagnosing local network connectivity issues and security threats.

The Address Resolution Protocol (ARP) bridges the gap between Layer 3 (IPv4 addresses) and Layer 2 (MAC addresses) of the OSI model. When a Linux system communicates with another device on the same local area network (LAN), it requires the target device's physical MAC address. To avoid broadcasting an ARP request for every packet, the kernel stores recent IP-to-MAC translations in memory, known as the ARP cache. The arp command is a dedicated networking utility used to inspect, modify, and manage this cache.

Viewing the ARP Cache

The primary purpose of the arp command is to inspect the current state of the local network mappings. Running the command without flags or with -e displays the active ARP table in standard format:

arp

To display entries in BSD-style format, use the -a option:

arp -a

By default, the command attempts to resolve IP addresses into hostnames via reverse DNS, which can introduce delays. To display purely numerical IP addresses and speed up output, combine it with the -n flag:

arp -n

A typical entry in this table includes:

• Address: The target IPv4 address.
• HWtype: The hardware link-layer type (usually ether for Ethernet).
• HWaddress: The hardware (MAC) address of the remote device.
• Flags: State markers, such as C (complete/dynamic) or M (permanent/static).
• Iface: The local network interface (e.g., eth0, wlan0) associated with the mapping.

Cache Management and Manipulation

Beyond passive inspection, the arp utility provides administrative controls to modify entries manually:

• Adding Static Mappings: Administrators can map an IP directly to a MAC address using arp -s <IP> <MAC>. Static mappings remain fixed and cannot be overwritten by automatic network broadcasts.
• Deleting Stale Entries: If a network card is replaced or an IP address is reassigned, old entries can cause dropped packets. Removing an invalid record is done via arp -d <IP>.

Practical Diagnostics and Security

Inspecting the ARP cache serves several critical functions during system administration:

• Layer 2 Verification: Checking the table confirms whether a host has physically responded to network requests. If an IP shows an incomplete hardware address, the target device is either offline, blocking traffic, or isolated by a VLAN/subnet configuration.
• Detecting ARP Spoofing: In an ARP poisoning attack, a malicious actor sends forged ARP replies to link their MAC address with a legitimate IP, such as the default gateway. Regularly inspecting the ARP table helps identify duplicate MAC addresses assigned to multiple distinct IP addresses.

While modern Linux distributions often utilize the newer ip neighbor command from the iproute2 suite, the traditional arp command remains a widely used, foundational tool for rapid LAN troubleshooting and cache verification.