arp command in Linux with examples

arp command manipulates the System’s ARP cache. It also allows a complete dump of the ARP cache. ARP stands for Address Resolution Protocol. The primary function of this protocol is to resolve the IP address of a system to its mac address, and hence it works between level 2(Data link layer) and level 3(Network layer). 

Syntax:

arp [-v] [-i if] [-H type] -a [hostname]

Example: Here we created two machines with name machine1 and machine2 with IP address 10.0.2.4 and 10.0.2.5 

• Screenshot of hosts before adding 

• Addition of host 

• Hosts file after adding machines 

• Now checking arp for all 

Options:

• -v, –verbose: This option shows the verbose information.
• -n, –numeric: This option shows numerical addresses instead of symbolic host, port or usernames. 

• -H type, –hw-type type, -t type: This tells arp which class of entries it should check for. Default value is ether. List of possible hardware types(which support ARP) are ash(Ash), ether(Ethernet), ax25(AMPR AX.25), netrom (AMPR NET/ROM), rose (AMPR ROSE), arcnet (ARCnet), dlci (Frame Relay DLCI), fddi (Fiber Distributed Data Interface), hippi (HIPPI), irda (IrLAP), x25 (generic X.25), eui64 (Generic EUI-64). 

• -a [hostname] –all: This option is used for showing entries of the specified host. If nothing is passed all entries will be displayed. 

• -d hostname, –delete hostname: Removes any entry for the specified host. If any host is down, there is no need of keeping its entry in arp cache so this command is used to delete those entries explicitly by the user. 

• -D, –use-device: Use the given interface’s hardware address. 

• -e: Shows the entries in default(Linux) Style.
• -i If, –device If: Select an interface. When dumping the ARP cache, only entries matching the specified interface will be printed. 

  Note: This has to be different from the interface to which the IP datagrams will be routed.

• -s hostname hw_address: Manually create an ARP address mapping entry for the host hostname with its mac address as hw_address. 

• -f filename: Works same as -s but instead of giving the entries manually, it takes entry from the file given as parameter. 

Some useful flags are: 

• -C: Complete entry.
• -M: Permanent entry.
• -P: Published entry.

Some useful file related to these data are:

• /proc/net/arp
• /etc/networks
• /etc/hosts/
• /etc/ethers