Home » Blog » The “arp” Command in Linux [7 Practical Examples]

Linux Commands

The “arp” Command in Linux [7 Practical Examples]

Walid Al Asad

March 1, 2023

The arp command in Linux is used to map IP addresses to MAC (Physical) addresses on a LAN (Local Area Network). Every computer memory store ARP (Address Resolution Protocol) cache (or ARP table) which contains the mapping of IP address and MAC address on a LAN. And, You can manage the ARP cache using the arp command in Linux. In this article, I will try to familiarize you with the arp command with some practical and useful examples.

A. Description

The MAC (Media Access Control) or physical address is a unique code assigned to a NIC (Network Interface Controller). NIC is a hardware component responsible for communication. MAC address is important because it allows communication between all LAN devices Using MAN protocol. The ARP cache keeps records of the IP address and their corresponding MAC addresses of all devices connected to a LAN. And, the arp command in Linux is used to access the ARP cache and manage it.

B. Syntax

The syntax of the arp command in Linux goes like the following:

arp [OPTION]... [HOSTNAME/IP ADDRESS]

C. Options

The arp command in Linux provides some options and you can use them according to your need. To know about the options, execute the following command:

man arp

Here I have listed some of the necessary options for you:

Useful Options

Practical Examples of the “arp” Command in Linux

Now I will provide some practical and useful examples of the arp command in Linux. Follow them with me.

Example 1: Prints IP Addresses and Mac Addresses Using the “arp” command in Linux

In the first example, I will pick in the ARP cache to see all the IP entries and their corresponding MAC addresses. All I need to do for that purpose is type the arp command in the terminal. To print IP addresses and their corresponding MAC addresses, do the following:

Steps to Follow:

➊ At the beginning, go to your Ubuntu and open a Terminal.

➋ Copy the following command in the command prompt:

arp

➌ Print ENTER from the keyboard.

Output:

In the output, you will see the following four columns:

The image below is showing all the columns.

Similar Readings

• The “iptables” Command in Linux [6 Practical Examples]
• The “tcpdump” Command in Linux [6+ Practical Examples]
• The “nslookup” Command in Linux [12 Practical Examples]
• The “ufw” Command in Linux [12+ Practical Examples]

Example 2: Print All Hosts on the ARP Cache

The arp command in Linux shows all the current hosts by default. However, if you use option “-a”, it will show all the hosts on the LAN.

To print all the hosts, do the following:

Steps to Follow:

➊ First, launch an Ubuntu Terminal.

➋ Write the following command in the Terminal:

arp -a

➌ Hit ENTER on the keyboard.

Output:

Unlike “arp”, the output of the “arp -a” command doesn’t have any column heading. At first, you will see the hostname. If the hostname isn’t available, you will just see the question mark (“?”). Then you will see the IP address, Mac address, Protocol type (HWtype) and network interface respectively.

Example 3: Enable Verbose Mode in the “arp” Command in Linux

The arp command in Linux provides an option “-v” to enable verbose mode. In verbose mode, the arp command provides an extra line at the end showing the number of ARP cache entries etc. To enable verbose mode, follow the steps below:

Steps to Follow:

➊ Open a Terminal in Ubuntu first.

➋ Insert the following command in the command prompt:

arp -v

➌ Now find the ENTER button on your keyboard and press it.

Output:

In the output, you can see an extra line on the bottom showing “Entries”, “Skipped” and “Found”.

Example 4: Arp Cache Entries in Numerical Format

The “-n” option in the arp command in Linux shows output in the numerical format. So, what will be the difference in the output? You will see an IP address in place of the hostname. Moreover, “arp -n” doesn’t resolve IP addresses to MAC addresses. It only shows what is in the ARP cache. So, you might see an IP address in place MAC address.

To print ARP cache entries in numerical format, do the following:

Steps to Follow:

➊ Launch a Terminal in Ubuntu first.

➋ Type the following command in the Terminal:

arp -n

➌ Hit ENTER on your keyboard.

Output:

In previous examples, you might notice there is a hostname “_gateway”. However, in this output, you can see only its corresponding IP address. You can check it by matching the MAC address. Otherwise, everything is similar to the output of Example 1 and Example 3.

Example 5: Delete A Host Using the “arp” Command in Linux

It is possible to delete a particular host from the ARP cache. The arp command in Linux provides an option for that which is the option “-d”. Firstly, I executed the following command to see all the hosts:

arp

As you can see, there is a host with the IP address 192.168.0.54 and I want to delete it.

Now to delete a host, follow the steps below:

Steps to Follow:

➊ Firstly, open a Terminal in Ubuntu.

➋ Copy the following command and edit it accordingly and hit ENTER:

sudo arp -d 192.168.0.54

❸ Provide the password if necessary.

➌ Go to your keyboard and press ENTER again.

Output:

I used the following command to list out all the hosts:

arp

And, you can see, there is no host with the IP address 192.168.0.54. So it is deleted from the ARP cache.

Similar Readings

• The “traceroute” Command in Linux [13 Practical Examples]
• The “rsync” Command in Linux [10 Practical Examples]
• The “screen” Command in Linux [13 Practical Examples]
• The “ssh” Command in Linux [18 Practical Examples]

Example 6: Applying the “arp” Command for a Particular IP Address

If you are interested in a particular IP address and its MAC address, you can only print its information using option “-a” of the arp command in Linux. For instance, there is an IP address 192.168.0.217 and I want to know its corresponding MAC address and other information. To apply the arp command for a particular IP address, do the following:

Steps to Follow:

➊ Press CTRL + ALT + T to open an Ubuntu Terminal.

➋ Write the following command in the command prompt:

arp -a 192.168.0.217

➌ Hit the ENTER button.

Output:

The output format is similar to Example 1 where I used option “-a” as well. However, here I have provided an IP address. That is why it is only showing information for a single host.

Example 7: Prints Hosts With A Specific Type of Network Protocol

Suppose, I want to see all the hosts with a specific network protocol. The arp command in Linux has a dedicated option “-H” for that purpose. In this example, I will print all the hosts with ethernet protocol, which means I need to provide “ether” as the value of the option “-H”. To print hosts with a specific type of network protocol, follow the steps below:

Steps to Follow:

➊ Press CTRL + ALT + T to launch a Terminal in Ubuntu.

➋ Insert the following command in the Terminal:

arp -H ether

➌ Hit ENTER from your keyboard.

Output:

In my case, there was no other protocol except “ether” (or ethernet). That is why you might not see a difference. However, if my LAN consisted of other internet protocols, I wouldn’t see them here as I had only specified protocol “ether” (or ethernet).

Conclusion

The arp command in Linux can be pretty hard for a beginner as you need some prior networking concepts. In this article, I have tried to explain it as easily as possible with examples. Hopefully, you have found that helpful.

Similar Readings

• The “wget” Command in Linux [14 Practical Examples]
• The “ping” Command in Linux [9 Practical Examples]
• The “curl” Command in Linux [9 Practical Examples]
• The “ dig” Command in Linux [10 Practical Examples]
• The “hostname” Command in Linux [12 Practical Examples]
• The “ip” Command in Linux [9+ Practical Examples]
• The “ifconfig” Command in Linux [6+ Practical Examples]