The arp command in Linux is used to map IP addresses to MAC (Physical) addresses on a LAN (Local Area Network). Every computer memory store ARP (Address Resolution Protocol) cache (or ARP table) which contains the mapping of IP address and MAC address on a LAN. And, You can manage the ARP cache using the arp command in Linux. In this article, I will try to familiarize you with the arp command with some practical and useful examples.
A. Description
The MAC (Media Access Control) or physical address is a unique code assigned to a NIC (Network Interface Controller). NIC is a hardware component responsible for communication. MAC address is important because it allows communication between all LAN devices Using MAN protocol. The ARP cache keeps records of the IP address and their corresponding MAC addresses of all devices connected to a LAN. And, the arp command in Linux is used to access the ARP cache and manage it.
B. Syntax
The syntax of the arp command in Linux goes like the following:
arp [OPTION]... [HOSTNAME/IP ADDRESS]C. Options
The arp command in Linux provides some options and you can use them according to your need. To know about the options, execute the following command:
man arpHere I have listed some of the necessary options for you:
Useful Options
- -a, shows all ARP cache entries.
- -v, –verbose, enable verbose mode.
- -n,–numeric, provides output in numerical format.
- -d, is used to delete a host.
- -H,–hw-type, is used to specify network protocol.
Note: The options in Linux CLI (Command Line Interface) are all case-sensitive, So, use them carefully.
Practical Examples of the “arp” Command in Linux
Now I will provide some practical and useful examples of the arp command in Linux. Follow them with me.
Example 1: Prints IP Addresses and Mac Addresses Using the “arp” command in Linux
In the first example, I will pick in the ARP cache to see all the IP entries and their corresponding MAC addresses. All I need to do for that purpose is type the arp command in the terminal. To print IP addresses and their corresponding MAC addresses, do the following:
Steps to Follow >
➊ At the beginning, go to your Ubuntu and open a Terminal.
➋ Copy the following command in the command prompt:
arp➌ Print ENTER from the keyboard.
Output >
In the output, you will see the following four columns:
- Address: IP address or hostname of the devices on the LAN.
- HWtype: Network protocol type (for instance – ether). Here ether means ethernet protocol.
- HWaddress: MAC addresses of the devices.
- Flags Mask: ARP cache entry type. C – Dynamically learned entry, M– Manually entered entry, P – Published entry, tell the host to respond to ARP request and ARP respond packets.
- Iface: Name of the network interface.
The image below is showing all the columns.
Similar Readings
- The “iptables” Command in Linux [6 Practical Examples]
- The “tcpdump” Command in Linux [6+ Practical Examples]
- The “nslookup” Command in Linux [12 Practical Examples]
- The “ufw” Command in Linux [12+ Practical Examples]
Example 2: Print All Hosts on the ARP Cache
The arp command in Linux shows all the current hosts by default. However, if you use option “-a”, it will show all the hosts on the LAN.
To print all the hosts, do the following:
Steps to Follow >
➊ First, launch an Ubuntu Terminal.
➋ Write the following command in the Terminal:
arp -a➌ Hit ENTER on the keyboard.
Output >
Unlike “arp”, the output of the “arp -a” command doesn’t have any column heading. At first, you will see the hostname. If the hostname isn’t available, you will just see the question mark (“?”). Then you will see the IP address, Mac address, Protocol type (HWtype) and network interface respectively.
Example 3: Enable Verbose Mode in the “arp” Command in Linux
The arp command in Linux provides an option “-v” to enable verbose mode. In verbose mode, the arp command provides an extra line at the end showing the number of ARP cache entries etc. To enable verbose mode, follow the steps below:
Steps to Follow >
➊ Open a Terminal in Ubuntu first.
➋ Insert the following command in the command prompt:
arp -v➌ Now find the ENTER button on your keyboard and press it.
Output >
In the output, you can see an extra line on the bottom showing “Entries”, “Skipped” and “Found”.
- Entries: Number of ARP cache entries.
- Skipped: Number of entries skipped by the arp
- Found: Number of entries processed by the arp
Example 4: Arp Cache Entries in Numerical Format
The “-n” option in the arp command in Linux shows output in the numerical format. So, what will be the difference in the output? You will see an IP address in place of the hostname. Moreover, “arp -n” doesn’t resolve IP addresses to MAC addresses. It only shows what is in the ARP cache. So, you might see an IP address in place MAC address.
To print ARP cache entries in numerical format, do the following:
Steps to Follow >
➊ Launch a Terminal in Ubuntu first.
➋ Type the following command in the Terminal:
arp -n➌ Hit ENTER on your keyboard.
Output >
In previous examples, you might notice there is a hostname “_gateway”. However, in this output, you can see only its corresponding IP address. You can check it by matching the MAC address. Otherwise, everything is similar to the output of Example 1 and Example 3.
Example 5: Delete A Host Using the “arp” Command in Linux
It is possible to delete a particular host from the ARP cache. The arp command in Linux provides an option for that which is the option “-d”. Firstly, I executed the following command to see all the hosts:
arpAs you can see, there is a host with the IP address 192.168.0.54 and I want to delete it.
Now to delete a host, follow the steps below:
Steps to Follow >
➊ Firstly, open a Terminal in Ubuntu.
➋ Copy the following command and edit it accordingly and hit ENTER:
sudo arp -d 192.168.0.54❸ Provide the password if necessary.
➌ Go to your keyboard and press ENTER again.
Output >
I used the following command to list out all the hosts:
arpAnd, you can see, there is no host with the IP address 192.168.0.54. So it is deleted from the ARP cache.
Similar Readings
- The “traceroute” Command in Linux [13 Practical Examples]
- The “rsync” Command in Linux [10 Practical Examples]
- The “screen” Command in Linux [13 Practical Examples]
- The “ssh” Command in Linux [18 Practical Examples]
Example 6: Applying the “arp” Command for a Particular IP Address
If you are interested in a particular IP address and its MAC address, you can only print its information using option “-a” of the arp command in Linux. For instance, there is an IP address 192.168.0.217 and I want to know its corresponding MAC address and other information. To apply the arp command for a particular IP address, do the following:
Steps to Follow >
➊ Press CTRL + ALT + T to open an Ubuntu Terminal.
➋ Write the following command in the command prompt:
arp -a 192.168.0.217➌ Hit the ENTER button.
Output >
The output format is similar to Example 1 where I used option “-a” as well. However, here I have provided an IP address. That is why it is only showing information for a single host.
Example 7: Prints Hosts With A Specific Type of Network Protocol
Suppose, I want to see all the hosts with a specific network protocol. The arp command in Linux has a dedicated option “-H” for that purpose. In this example, I will print all the hosts with ethernet protocol, which means I need to provide “ether” as the value of the option “-H”. To print hosts with a specific type of network protocol, follow the steps below:
Steps to Follow >
➊ Press CTRL + ALT + T to launch a Terminal in Ubuntu.
➋ Insert the following command in the Terminal:
arp -H ether➌ Hit ENTER from your keyboard.
Output >
In my case, there was no other protocol except “ether” (or ethernet). That is why you might not see a difference. However, if my LAN consisted of other internet protocols, I wouldn’t see them here as I had only specified protocol “ether” (or ethernet).
Conclusion
The arp command in Linux can be pretty hard for a beginner as you need some prior networking concepts. In this article, I have tried to explain it as easily as possible with examples. Hopefully, you have found that helpful.
Similar Readings
- The “wget” Command in Linux [14 Practical Examples]
- The “ping” Command in Linux [9 Practical Examples]
- The “curl” Command in Linux [9 Practical Examples]
- The “ dig” Command in Linux [10 Practical Examples]
- The “hostname” Command in Linux [12 Practical Examples]
- The “ip” Command in Linux [9+ Practical Examples]
- The “ifconfig” Command in Linux [6+ Practical Examples]
