arp command

---

The Address Resolution Protocol (ARP) is used by hosts to determine which MAC address is associated with an IP address on the local network.

• ARP queries are sent as broadcasts
  • can generate significant traffic
• to optimize this, the results of an ARP broadcast are cached in an ARP table
  • if the entry is used within the timeout period, it is held in the cache for a few minutes before deleted
• arp command performs functions related to ARP table cache
  • used to diagnose problem with local addressing and packet delivery
• arp -a (or arp -g) shows the ARP cache contents
  • can use with IPAddress to view the ARP cache for a specified interface
  • will not contain the MAC addresses of every host on the segment
  • will be no cache entry if there has not been a recent exchange of frames
• arp -s IPAddress MACAddress adds an entry to the ARP cache
  • in Windows, MACAddress needs to be entered with hyphens
• arp -d * deletes all entries in the ARP cache
  • can be used with IPAddress to delete a single entry

In Linux, ip neigh shows entries in the local ARP cache

• replaces old arp command

Info

• ARP cache is different than MAC address table
• ARP cache is maintained by layer 3 hosts and routers to map IP addresses to MAC addresses
• switch’s MAC address table contains the MAC addresses that the switch as seen on each of its ports