LearnLinux › cmds › commands

arptables

Filter and manipulate ARP packets in the Linux bridge/ethernet layer. Useful for LAN security controls, ARP spoofing mitigation, and bridge-based filtering.

Category: Security / Networking ARP Filtering Bridge / L2 Legacy iptables-family

What it does

arptables is a packet-filtering framework for ARP traffic, similar in spirit to iptables but specifically for ARP frames. It can accept, drop, log, or modify ARP packets based on fields like sender/target IP, sender/target MAC, interface, and ARP operation.

How it works (mechanical)

ARP is a link-layer protocol used to resolve IPv4 addresses to MAC addresses. The kernel’s ARP layer processes ARP requests/replies, and arptables hooks into that path with rule chains (tables) to match and act on packets.

  • Matches ARP opcode (request/reply)
  • Matches sender/target IP and MAC
  • Applies actions: ACCEPT, DROP, LOG (and some targets depending on build)
  • Often used on bridge hosts or security gateways on a LAN

10 Practical Examples

# 1) List current rules (numeric, verbose)
sudo arptables -L -n -v
# 2) List rules for a specific chain (default filter table)
sudo arptables -L INPUT -n -v
# 3) Flush all rules
sudo arptables -F
# 4) Set default policy for INPUT chain (ACCEPT or DROP)
sudo arptables -P INPUT DROP
# 5) Allow ARP from a specific trusted MAC (example)
sudo arptables -A INPUT --source-mac 00:11:22:33:44:55 -j ACCEPT
# 6) Drop ARP replies not coming from the gateway MAC (simple anti-spoof idea)
#    Replace values with YOUR gateway IP and MAC:
sudo arptables -A INPUT --opcode 2 --source-ip 192.168.1.1 --source-mac ! aa:bb:cc:dd:ee:ff -j DROP
# 7) Log suspicious ARP packets (rate limiting is not built-in here; be careful)
sudo arptables -A INPUT -j LOG
# 8) Apply rules only on a specific interface
sudo arptables -A INPUT -i br0 --opcode 1 -j ACCEPT
# 9) Show rules as they are processed (useful for debugging)
sudo arptables -L --line-numbers -n -v
# 10) Save and restore rules (varies by distro; examples shown)
# Save
sudo arptables-save > /etc/arptables.rules
# Restore
sudo arptables-restore < /etc/arptables.rules

Notes & Gotchas

  • Be cautious with DROP policies: you can break LAN connectivity quickly.
  • Order matters: first matching rule wins (like iptables).
  • Logging can flood: ARP can be chatty; logging everything can be noisy.
  • Persistence differs: saving/restoring is distro-specific (systemd services, init scripts, etc.).
  • Legacy stack: many environments prefer nftables now, but arptables is still encountered.

Historical Context

arptables was created alongside iptables/ebtables as part of the “tables” family for filtering across protocol layers (L3, L2, and ARP). Over time, Linux consolidated packet filtering around nftables, but arptables remains useful on older systems and for certain bridge-centric setups.

Modern Equivalent / Related Tools

  • nft — modern packet filtering framework (can filter ARP at L2)
  • ebtables — ethernet bridge filtering (L2)
  • iptables / ip6tables — L3/L4 filtering (legacy)
  • ip neigh — view/flush ARP cache entries
  • tcpdump -e arp — observe ARP frames live