Linux ARP And Commands

The (ARP)  stands for Address Resolution Protocol. The ARP work is to define the define the network interfaces connected to an ethernet media segment (hardware addresses) to map an IP address (logical addresses assigned to machines) to a link layer address which it do on demand. The link layer address is the correct term although it is interchangeably  used with  Ethernet addresses, Media Access Control (MAC) addresses.


 ARP is commonly used to translate the protocol addresses to hardware interface addresses. Modifying the ARP cache can change which interfaces handles the specific requests. ARP cache entries may be marked with the following flags:
C (complete), M (permanent), and P (publish)

While arp can create a proxy for a single system, subnet proxies can be handled by the arp kernel module.

 arp [-evn] [-H type] [-i if] -a [hostname]
arp [-v] [-i if] -d hostname [pub]
arp [-v] [-H type] [-i if] -s hostname hw_addr [temp]
arp [-v] [-H type] [-i if] -s hostname hw_addr [netmask nm] pub
arp [-v] [-H type] [-i if] -Ds hostname ifa [netmask nm] pub
arp [-vnD] [-H type] [-i if] -f [filename]

• -a [hosts] , --display [hosts] It displays the entries for hosts, if none of them are specified, all entries.
  

• -d host [pub] , --delete host [pub] Removes the specified host's entry. To delete a proxy entry, add the pub argument and specify the interface associated with the proxy using -i.
  

• -D, --use-device Use the hardware address associated with the specified interface. This may be used with -s when creating a proxy entry.
  

• -f file, --file file Read the entries from a file and add them.
  

• -H type, --hw-type type, -t type Search for type entries when examining the ARP cache. type is usually ether (Ethernet), which is the default, but may be ax25 (AX.25 packet radio), arcnet (ARCnet), pronet (PROnet), or netrom (NET/ROM).
  

• -i interface, --device interface Select an interface. If you need to dump the ARP cache, this option will cause the command to display  the entries using that interface. When setting entries, this will cause the interface to be associated with that entry. If you do not use this option when setting an entry, the kernel will guess.
  

• -n, --numeric Display host IP addresses instead of their domain names.
  

• -s host hardware-address [netmask mask] [pub] , --set host hardware-address [pub] It Adds a permanent entry for host at hardware-address. A hardware-address for type ether hardware is 6 hexadecimal bytes, colon-separated. The pub argument can be used to set the publish flag, creating a proxy entry.
  

• -v, --verbose Verbose mode.
  
  Here are all the possible states for entries in the neighbor table.
  
  
  Table 2.1. Active ARP cache entry states
  

  ARP cache entry state	meaning	action if used
  permanent	never expires; never verified	reset use counter
  noarp	normal expiration; never verified	reset use counter
  reachable	normal expiration	reset use counter
  stale	still usable; needs verification	reset use counter; change state to delay
  delay	schedule ARP request; needs verification	reset use counter
  probe	sending ARP request	reset use counter
  incomplete	first ARP request sent	send ARP request
  failed	no response received	send ARP request