How to Use arp Command in Linux?

Introduction

Before we start talking about how to use arp command on linux,let's briefly understand-What is an arp Command?

The arp command on Linux allows you to view and manipulate the Address Resolution Protocol (ARP) cache. This cache contains the mapping between IP addresses and MAC addresses on your local network. Using the arp command, you can display, add, delete, or modify entries in the ARP cache.

The net-tools package, a potent networking tool for converting an IP address to a mac address, includes an arp. Various machines are added/connected to a local server, which can be configured to transform the IP address to the mac address using IPv4 network interfaces.

In this tutorial, we will explore how to effectively use the arp command on Linux.

Install net-tools utility:

The net-tools package includes the arp command. We need to install the net tools before we can run the arp command. The subsequent command will install net-tools on your system:

sudo apt install net-tools                   #For Ubuntu/Debian-Based
sudo dnf install net-tools                   #For Fedora
sudo yum install net-tools                   #For CentOS

Let's check the general syntax of the arp command before using it. It is as follows:

Syntax of the arp Command:

arp [-v] [HW] [-i if] -a [hostname]

v: Displays the verbose feature of the arp command, which displays every step detail in the terminal.
HW: Indicates the hardware address, sometimes known as the "mac address". Default Ether.
i: Defines the network interface. as eth0.
hostname: Substitute the hostname or host IP address here.
a: Displays all hosts on the computer using the all flag of the arp command.

There are various built-in options for the arp command that provide it additional functionality. Use the command listed below to obtain the options and flags available in the arp command:

arp --help

The above image shows the arp options.

How to Use the arp Command on Linux?

Let's utilize the arp command on Linux to perform several tasks.

Example 1: Get the arp Cache Details Using the arp Command

The system's arp cache can be modified with the arp command. The "arp" command is used to inspect a machine's arp cache's contents:

Note: The "e" flag is utilized by default when the arp is used.

arp

The machine's arp command displays the following information:

Address: It shows the machine’s IP Address.
HWtype: Shows type of hardware.
HWaddress: Shows the “mac address” of the machine.
Flag Mask: It displays the flag for the machine.
C: Complete Entry.
P: Published Entry.
M: Permanent Entry.
Iface: Interface of the machine.

The "a" flag of the arp command is used to display all the host's system information. Use this command to show every entry on the machine:

arp -a

Use the command listed below to obtain all the details of a certain IP address:

arp -a 192.168.227.1

Example 2: Get Entries for Specific Interface Using the arp Command

Users can use the option to find out details about a certain user interface. Run the following command to obtain the entries of the "ens33" interface:

arp -i ens33

Example 3: Get Numeric Details Using the arp Command

The "n" option is utilized to display the output in numerical format. For instance, the command below is used to obtain numerical information about the IP address "192.168.227.1":

arp -n 192.168.227.1

Example 4: Add/Set a New Entry Using the arp Command

The arp command is most useful when adding/configuring a new machine/user to the local server. The "s" option of the arp command is used with IP and mac address to add a new entry to the machine. Let's examine that syntax:

sudo arp -s <ip-address> <mac-address>

This command can be used to add a computer with the IP address "192.168.227.130" and the mac address "00:0c:29:9a:7c:22" to the system's local server.

Note: Using the "arg" or "ifconfig" commands, we may determine the machine's mac address (HWaddress).

sudo arp -s 192.168.227.130 00:0c:29:9a:7c:22

The "arp" command is used to confirm the new user has been added successfully:

arp

The highlighted entry indicates that the new machine has been successfully added to the local machine server.

Example 5: Add a New User From the File Using the arp Command

The file allows us to add/set up new or numerous users/machines on the local server of our system. The file should contain both the machine's mac address and its replacement machine's ip address. Similar to this, adding a new machine can be done as follows using a file called "arpfile.txt" with the IP address "192.168.227.130" and the mac Address "00:0c:29:9a:7c:22":

Note: The "cat" command displays the file text.

cat arpfile.txt
sudo arp -f arpfile.txt

Example 6: Remove the Entry Using the arp Command

You can remove a user or machine from the local machine by using the "d" option of the arp command. The following methods can be used to remove a machine with the IP address "192.168.227.130":

sudo arp -d 192.168.227.130

After running the command, the removal of the user is shown in the output.

Pro Tip: Adding the User with ping

Here, we'll manually add a new IP address to the arp list. The following uses the ping command with the IP address "192.168.227.130" (an IP address is any user-defined address) to accomplish this:

ping 192.168.227.130

Use the following command to check that a new entry is connected to the host of the local server:

arp

It can be observed that the newly pinged IP address has been added to the arp list.

FAQs: Using the `arp` Command on Linux

What is the purpose of the `arp` command on Linux?

The arp command allows you to manage the ARP cache on a Linux system. You can view, add, delete, or modify entries in the ARP cache using this command.

How do I view the ARP cache using the `arp` command?

To view the ARP cache, use the command arp -a. It will display a list of IP addresses and their associated MAC addresses in the cache.

Can I view a specific IP address in the ARP cache?

Yes, you can pass a specific IP address to the arp command to view its corresponding MAC address. Use the command arp <IP address>.

How do I add an entry to the ARP cache using the `arp` command?

To manually add an entry to the ARP cache, you can use the arp -s command followed by the IP address and MAC address you want to map, like this: arp -s <IP address> <MAC address>.

Can I delete an entry from the ARP cache using the `arp` command?

Yes, you can delete an entry from the ARP cache using the arp -d command followed by the IP address, like this: arp -d <IP address>.

Do changes made to the ARP cache using the `arp` command persist across reboots?

No, changes made to the ARP cache using the arp command are not persistent. They are lost upon system reboot.

Are there any alternative commands or tools to manage the ARP cache?

Yes, alternative commands such as ip neighbor or netstat -n can also be used to view or manipulate the ARP cache on Linux systems.

Conclusion

The arp command on Linux is used to connect and interact between the two devices by translating the machine IP address to the physical address.

This command can be used to connect a new machine, acquire information about the machines connected to the local server, and disconnect an existing user or machine.

Furthermore, several uses of the arp command are explored throughout this tutorial.

If you have any queries, feel free to mention below.