How do you view the ARP address table?

device# show arp
Total number of ARP entries: 2
Entries in default routing instance:
No.   IP Address       MAC Address    Type     Age Port               Status
1     10.1.1.100       0000.0000.0100 Dynamic  0    1/1/1*2/1/25      Valid                        
2     10.37.69.129     02e0.5215.cae3 Dynamic  0    mgmt1             Valid

By , Unix Dweeb, Network World |

One useful tool for diagnosing network troubles is the arp command -- a tool which allows

you to display the IP address to hardware (MAC) address mappings that a system has built so that it doesn't have to fetch the same information repeatedly for systems it communicates with.

To display the ARP table on a Unix system, just type "arp -a" (this same command will show the arp table in the command prompt on a Windows box, by the way). The output from arp -a will list the network interface, target system and physical (MAC) address of each system.

$ arp -a

Net to Media Table: IPv4
Device   IP Address               Mask      Flags   Phys Addr
------ -------------------- --------------- ----- ---------------
dmfe0  router.mynet.org     255.255.255.255       00:06:2a:77:4f:0d
dmfe0  server1.mynet.org    255.255.255.255       00:03:ba:24:de:11
dmfe0  myself               255.255.255.255 SP    00:03:ba:91:03:18

In this display, the following flags have been used:

S == static
P == publish (i.e., explicitly added by an arp -s command)

Other addresses may be static as well as the one indicated above, but these entries were picked up as a response to network traffic, not statically added to the table through a deliberate arp -s command.

The network interface (there may be more than one) and each host the system is reaching through that interface and its physical address is listed. The netmasks are all 255.255.255.255 since all the references are host-specific.

Using a tool like the one at http://aruljohn.com/mac.pl, you can determine the manufacturer of each of the network interfaces listed. The 00:06:2a:... address at the top of the list, for example, indicates that router.mynet.org is a Cisco device.

The following script prints just the destination addresses (IP addresses or names) for which MAC addresses have been cached. Note that these will all be local (same LAN) addresses since any connections for outside the local network will just go through the default router.

#!/bin/bash

for dest in `arp -a | tail +5 | awk '{print $2}'`
do
    nslookup $dest 1>/tmp/arp$$ 2>/dev/null
    if [ `wc -l /tmp/arp$$ | awk '{print $1}'` -ge 4 ]; then
        tail -2 /tmp/arp$$ | grep Address | awk '{print $2}'
    fi
done

rm /tmp/arp$$

So, you expect to see a listing of IP addresses from the local network and, among these, your default router.

$ ./showConnex
10.1.2.1
10.1.2.3
10.1.2.11

Sandra Henry-Stocker has been administering Unix systems for more than 30 years. She describes herself as "USL" (Unix as a second language) but remembers enough English to write books and buy groceries. She lives in the mountains in Virginia where, when not working with or writing about Unix, she's chasing the bears away from her bird feeders.

Copyright © 2010 IDG Communications, Inc.

           arp [-v] [-t hwtype] -a [hostname]
           arp [-v] [-t hwtype] -s hostname hwaddr
           arp [-v] -d hostname [hostname...]
 

The first invocation displays the ARP entry for the IP-address or host specified, or all hosts known if no hostname is given. For example, invoking arp on vlager may yield

           # arp -a
           IP address      HW type                 HW address
           191.72.1.3      10Mbps Ethernet         00:00:C0:5A:42:C1
           191.72.1.2      10Mbps Ethernet         00:00:C0:90:B3:42
           191.72.2.4      10Mbps Ethernet         00:00:C0:04:69:AA

Using the -t option you can limit the display to the hardware type specified. This may be ether, ax25, or pronet, standing for 10Mbps Ethernet, AMPR-AX.25, and IEEE-802.5 token ring equipment, respectively.

The -s option is used to permanently add hostname's Ethernet address to the ARP tables. The hwaddr argument specifies the hardware address, which is by default expected to be an Ethernet address, specified as six hexadecimal bytes separated by colons. You may also set the hardware address for other types of hardware, too, using the -t option.

One problem which may require you to manually add an IP-address to the ARP table is when for some reasons ARP queries for the remote host fail, for instance when its ARP driver is buggy or there is another host in the network that erroneously identifies itself with that host's IP-address. Hard-wiring IP-addresses in the ARP table is also a (very drastic) measure to protect yourself from hosts on your Ethernet that pose as someone else.

Invoking arp using the -d switch deletes all ARP entries relating to the given host. This may be used to force the interface to re-attempt to obtain the Ethernet address for the IP-address in question. This is useful when a misconfigured system has broadcast wrong ARP information (of course, you have to reconfigure the broken host before).

The -s option may also be used to implement proxy ARP. This is a special technique where a host, say gate, acts as a gateway to another host named fnord, by pretending that both addresses refer to the same host, namely gate. It does so by publishing an ARP entry for fnord that points to its own Ethernet interface. Now when a host sends out an ARP query for fnord, gate will return a reply containing its own Ethernet address. The querying host will then send all datagrams to gate, which dutyfully forwards them to fnord.

These contortions may be necessary, for instance, when you want to access fnord from a DOS machine with a broken TCP implementation that doesn't understand routing too well. When you use proxy ARP, it will appear to the DOS machine as if fnord was on the local subnet, so it doesn't have to know about how to route through a gateway.

Another very useful application of proxy ARP is when one of your hosts acts as a gateway to some other host only temporarily, for instance through a dial-up link. In a previous example, we already encountered the laptop vlite which was connected to vlager through a PLIP link only from time to time. Of course, this will work only if the address of the host you want to provide proxy ARP for is on the same IP subnet as your gateway. For instance, vstout could proxy ARP for any host on the Brewery subnet (191.72.1.0), but never for a host on the Winery subnet (191.72.2.0).

The proper invocation to provide proxy ARP for fnord is given below; of course, the Ethernet address given must be that of gate.

           # arp -s fnord 00:00:c0:a1:42:e0 pub
 

           # arp -d fnord

Which command is used to view arp table?

Where is the arp table present?

How do I find the arp table in Windows 10?

How do I find my IP address with arp?