The “arp” Command in Linux [7 Practical Examples]

A Complete Guide for Beginners Enroll Course Now

The arp command is a utility used to display and manipulate the Address Resolution Protocol (ARP) cache. It allows users to view the contents of the ARP cache, manually add or remove entries from the cache, and flush the entire cache if needed.

In this article, I will try to familiarize you with the “arp” command with some practical and useful examples.

Syntax of “arp” Command

The syntax of the arp command in Linux goes like the following:


Note: The OPTION enclosed by square brackets ([]), followed by three dots denotes that you can use multiple options at the same time. Additionally, you may be required to provide a hostname or IP address. However, you can’t provide multiple hostnames or IP addresses.

Options for “arp” Command

To know about the options, execute the following command:

man arp

Here is some of the necessary options of arp command:

Option Description
-a Shows all ARP cache entries.
-v or –verbose Enable verbose mode.
-n or –numeric Provides output in numerical format.
-d Delete a host.
-H or –hw-type Specifies network protocol.

Note: The options are all case-sensitive, So, use them carefully.

How Does “arp” Command Work?

The arp command in Linux manages the Address Resolution Protocol (ARP) cache, which maps IP addresses to MAC addresses on a local network. It allows users to view the cache, add or remove entries, and clear the cache. When a device needs to communicate with another device, it sends out an ARP request to obtain the MAC address corresponding to the target IP address. The “arp” command facilitates troubleshooting network connectivity by managing these mappings.

Uses of the “arp” Command in Linux

Here are some practical and useful examples of the arp command in Linux:

1. Print IP Addresses and Mac Addresses Using the “arp” command in Linux

In the first example, I will pick in the ARP cache to see all the IP entries and their corresponding MAC addresses. All I need to do for that purpose is type the arp command in the terminal. To print IP addresses and their corresponding MAC addresses, do the following:

  1. At the beginning, go to your Ubuntu and open a Terminal.
  2. Copy the following command in the command prompt:
  3. Print ENTER from the keyboard.

In the output, you will see the following five columns:

  1. Address: IP address or hostname of the devices on the LAN.
  2. HWtype: Network protocol type (for instance – ether). Here ether means ethernet protocol.
  3. HWaddress: MAC addresses of the devices.
  4. Flags Mask: ARP cache entry type. C – Dynamically learned entry, M- Manually entered entry, P – Published entry, tell the host to respond to ARP request and ARP respond packets.
  5. Iface: Name of the network interface.

The image below shows all the columns from the output.Showing IP addresses and MAC addresses using the arp command in Linux

Similar Readings

2. Print All Hosts on the ARP Cache

The arp command in Linux shows all the current hosts by default. However, use option -a to show all the hosts on the LAN.

arp -a

Unlike “arp”, the output of the arp -a command doesn’t have any column heading. At first, you will see the hostname. If the hostname isn’t available, you will see the question mark (“?”). Then you will see the IP address, Mac address, Protocol type (HWtype), and network interface respectively.Showing all ARP cache entries

3. Enable Verbose Mode in the “arp” Command in Linux

The arp command in Linux provides an option -v to enable verbose mode. In verbose mode, the command command provides an extra line at the end showing the number of ARP cache entries etc. To enable verbose mode, use the command below:

arp -v

In the output, you can see an extra line on the bottom showing “Entries”, “Skipped” and “Found”.

  • Entries: Number of ARP cache entries.
  • Skipped: Number of entries skipped by the arp
  • Found: Number of entries processed by the arp
Enabling verbose mode in the arp command in Linux

4. Arp Cache Entries in Numerical Format

The -n option in the arp command in Linux shows output in the numerical format. You will see an IP address in place of the hostname. Moreover, arp -n doesn’t resolve IP addresses to MAC addresses. It only shows what is in the ARP cache. So, you might see an IP address in place MAC address.

To print ARP cache entries in numerical format, use the below command:

arp -n

In previous examples, you might notice a hostname “_gateway”. However, in this output, you can see only its corresponding IP address. You can check it by matching the MAC address. Displaying output in numerical format

5. Delete A Host Using the “arp” Command in Linux

It is possible to delete a particular host from the ARP cache. The arp command in Linux provides the -d option for that. First, execute the following command to see all the hosts:


Showing all the hostsLet’s say, you want to delete the host with the IP address To do that, use:

sudo arp -d

Now, again use arp to list all the hosts.Deleting a host using the arp command in LinuxAs you can see, there is no host with the IP address So, it is deleted from the ARP cache.

Similar Readings

6. Applying the “arp” Command for a Particular IP Address

If you are interested in a particular IP address and its MAC address, you can only print its information using option -a of the arp command in Linux. For example, to know the MAC address and other information of an IP address, use:

arp -a

Printing information of a specific host

7. Prints Hosts With A Specific Type of Network Protocol

The arp command in Linux has a dedicated option -H to see all the hosts with a specific network protocol. For example, to print all the hosts with ethernet protocol, use the command below::

arp -H ether

Specifying network protocol type in the arp command in Linux


The arp command in Linux can be pretty hard for a beginner as you need some prior networking concepts. In this article, I have tried to explain it as easily as possible with examples. Hopefully, you have found that helpful.

People Also Ask

What is “arp” command?

The arp command in Linux is a utility used for displaying and manipulating the Address Resolution Protocol (ARP) cache. It allows users to view the ARP cache, add or remove entries manually, and flush the entire cache. ARP is crucial for mapping IP addresses to MAC addresses on a local network, facilitating proper communication between devices. The “arp” command helps manage this process, aiding in network troubleshooting and maintenance.

How do I send an ARP request in Linux?

You can send an ARP request in Linux using the arping command. It is a utility specifically designed to send ARP requests and measure the time taken for the response. Here’s the basic syntax:

sudo arping -c 3 <IP_address>

Replace <IP_address> with the IP address to which you want to send the ARP request.

How to clear ARP in Linux?

To clear the ARP cache in Linux, you can use the ip or arp command, depending on your Linux distribution and version.

  1. Using ip command:
    sudo ip -s -s neigh flush all
  2. Using arp command:
    sudo arp -a -d

How do I use ARP and ping?

ARP and ping are two essential tools for network troubleshooting. ARP is used to map an IP address to a MAC address, while ping is used to test the connectivity between two devices. Here’s how you can use them together:

  1. First, use the arp command to check the ARP table cache on your Linux system.
  2. Once you have the MAC address of the device you want to ping, use the ping command to test the connectivity between the two devices. For example, if you want to ping the device with IP address, you can use the following command:

If the device is reachable, you should see a response from the device.

Where can I find a Linux ARP table?

On Linux systems, you can find the ARP (Address Resolution Protocol) table using the arp command or by checking the contents of the /proc/net/arp file.

  1. Open your terminal and simply type arp

    This command will display the ARP table, showing the IP addresses and their corresponding MAC addresses.

  2. Alternatively, you can check the contents of the /proc/net/arp file by using a command like cat or less:

    cat /proc/net/arp

Similar Readings

5/5 - (4 votes)
Walid Al Asad

Hello Everyone! I am Walid Al Asad. Currently, I am working at a tech company named Softeko as a Linux Content Developer Executive. I live in Dhaka, Bangladesh. I have completed my BSc. in Mechanical Engineering from Bangladesh University of Engineering and Technology (BUET). You can find me on LinkedIn, and ResearchGate. Read Full Bio

Leave a Comment