What it does
arp displays and modifies entries in the system’s ARP table, which stores mappings between IPv4 addresses and hardware (MAC) addresses for devices on the same local network segment.
How it works (mechanical)
When a system sends traffic to another IPv4 host on the same LAN,
it must know the target’s MAC address. If unknown, it broadcasts
an ARP request. The ARP reply is cached in the kernel ARP table.
The arp command reads and can modify that table.
- Reads ARP cache entries from kernel memory
- Displays IP-to-MAC mappings
- Can add static ARP entries
- Can delete ARP entries
10 Practical Examples
# 1) Show entire ARP table arp
# 2) Show ARP table in numeric form (no DNS lookup) arp -n
# 3) Show ARP entry for specific host arp 192.168.1.10
# 4) Add static ARP entry sudo arp -s 192.168.1.50 00:11:22:33:44:55
# 5) Delete ARP entry sudo arp -d 192.168.1.50
# 6) View ARP cache before/after ping test arp -n ping -c 1 192.168.1.1 arp -n
# 7) Identify duplicate IP issues arp -n | grep 192.168.1.100
# 8) Check if gateway MAC changed (possible ARP spoofing) arp -n | grep 192.168.1.1
# 9) Flush ARP cache (modern method preferred) sudo ip neigh flush all
# 10) Modern replacement to display ARP entries ip neigh show
Notes & Gotchas
- Deprecated:
arpis part of net-tools and largely replaced byip neigh. - IPv4 only: ARP does not apply to IPv6 (uses NDP instead).
- Static entries: Can prevent legitimate MAC changes (e.g., after hardware replacement).
- Security: ARP spoofing is a common LAN attack vector.
- Persistence: Static entries typically do not survive reboot unless scripted.
Historical Context
arp originated in the classic net-tools suite used widely
through the 1990s and early 2000s. Modern Linux systems prefer
iproute2 tools such as ip neigh, which provide
more consistent and feature-rich control.
Related Commands
- ip neigh — modern ARP/NDP management
- ip addr — interface addresses
- ip route — routing table
- ping — trigger ARP resolution
- tcpdump — observe ARP traffic live