How to use arp command in Linux.

How To Use Arp Command In Linux.

The arp command (Address Resolution Protocol) is a network utility used to display or modify the Address Resolution Protocol cache, which is a table used by network devices to map IP addresses to MAC addresses on a local network. ARP is essential for communication between devices on the same subnet.

arp command manipulates the System’s ARP cache. It also allows a complete dump of the ARP cache. ARP stands for Address Resolution Protocol. The primary function of this protocol is to resolve the IP address of a system to its mac address, and hence it works between level 2(Data link layer) and level 3(Network layer). 

ARP Command Basics

The arp command is a powerful utility that allows you to interact with and manage the ARP cache. It is available on various operating systems, including Windows, Linux, and macOS. The command-line syntax may vary slightly between platforms, but the basic functionality remains consistent.

Displaying ARP Cache Entries

To view the current entries in the ARP cache, open a command prompt or terminal window and enter the following command:

arp -a

This command will display a list of IP addresses and their corresponding MAC addresses in the ARP cache. The output may also include the type of network interface associated with each entry.

Adding Static ARP Entries

You can manually add static ARP entries to the cache. Static entries are useful when you want to ensure that a specific IP address is always associated with a particular MAC address. To add a static ARP entry, use the following command syntax:

arp -s [IPAddr] [EtherAddr]

• IPAddr: The IP address you want to map to a MAC address.
• EtherAddr: The MAC address corresponding to the IP address.

For example, to add a static ARP entry for an IP address 192.168.1.100 with the MAC address 00:1A:2B:3C:4D:5E, you would use the following command:

arp -s 192.1.1.100 00-1A-2B-3C-4D-5E

Deleting ARP Cache Entries

To remove a specific entry from the ARP cache, you can use the -d option followed by the IP address:

arp -d [IPAddr]

For instance, to delete the entry for the IP address 192.168.1.100, use:

arp -d 192.1.1.100

Real-World Examples

Let’s delve into some real-world scenarios to demonstrate the practical usage of the ARP command:

Example 1: Viewing ARP Cache Entries

Suppose you want to see a list of all devices currently present in your local network’s ARP cache. Open a command prompt or terminal and type:

arp -a

The output might include entries like:

Internet Address      Physical Address      Type
192.1.1.1           00-11-22-33-44-55     dynamic
192.1.1.10          00-AA-BB-CC-DD-EE     dynamic

This output provides the IP addresses, corresponding MAC addresses, and the entry type (dynamic, indicating it’s automatically managed).

Example 2: Adding a Static ARP Entry

Assume you have a device with the IP address 192.168.1.200 that you frequently communicate with, and you want to create a static ARP entry for it. Execute the following command:

arp -s 192.1.1.200 11-22-33-44-55-66

This creates a static mapping between the IP address and the MAC address 11-22-33-44-55-66.

Example 3: Deleting an ARP Cache Entry

Suppose you’ve decommissioned a device with the IP address 192.168.1.10, and you want to remove its entry from the ARP cache. Use the following command:

arp -d 192.1.1.10

This command removes the ARP entry associated with the specified IP address.

Conclusion

The ARP command is a powerful tool for managing the Address Resolution Protocol cache and ensuring efficient communication within a local network. By understanding how to use the arp command, you can troubleshoot networking issues, optimize network performance, and maintain accurate IP-to-MAC address mappings. Whether you’re viewing ARP cache entries, adding static mappings, or deleting outdated entries, the arp command is an essential component of any network administrator’s toolkit.