arp Linux Command
Displays and modifies the system's ARP cache (IP-to-MAC address mappings).
What does arp do?
Displays and modifies the system's ARP cache (IP-to-MAC address mappings).
Syntax
arp [options]Practical example
arp -aQuestions about arp
How do I see the ARP table?
Use `arp -a` to display all entries in the ARP cache. This shows IP addresses mapped to MAC addresses on your local network.
How do I add a static ARP entry?
Use `sudo arp -s IP-address MAC-address` to add a static entry. This is useful for preventing ARP spoofing on critical hosts.
How do I delete an ARP entry?
Use `sudo arp -d IP-address` to delete a specific entry, or `sudo arp -d *` to flush the entire ARP cache.
What is the ARP cache?
The ARP cache stores mappings between IP addresses and MAC addresses for devices on your local network. It is used to send Ethernet frames to the correct device.
How do I use the modern replacement for arp?
Use `ip neigh show` to display the ARP table (neighbor cache). Use `ip neigh add` and `ip neigh del` to modify entries.
How do I see only a specific interface's ARP table?
Use `arp -i eth0 -a` to show ARP entries only for the eth0 interface.
How do I do an ARP scan?
Use `arp-scan --localnet` or `nmap -sn 192.168.1.0/24` to discover all devices on your local network via ARP.
What is ARP spoofing?
ARP spoofing is an attack where a malicious actor sends fake ARP messages to associate their MAC address with another host's IP, allowing traffic interception.
Related Networking Commands
tracerouteTraces and displays the route packets take to reach a network host.
routeDisplays and modifies the IP routing table.
hostSimple utility for performing DNS lookups (forward and reverse).
hostnameShows or sets the system's hostname.
nslookupQueries DNS servers to resolve domain names to IP addresses and vice versa.
iwconfigDisplays and configures wireless network interface parameters.