The Address Resolution Protocol (ARP) is used to map an IP address to a physical (MAC) address. The arp command is used to display and modify the ARP cache, which is the table that maps IP addresses to MAC addresses. The arp command can be used to display the contents of the ARP cache, add or delete entries from the cache, and flush the entire cache.
Syntax
arp [options] [hostname]
Examples
Display the contents of the ARP cache:
arp
Add an entry to the ARP cache:
arp -s 192.168.1.1 00:11:22:33:44:55
Delete an entry from the ARP cache:
arp -d 192.168.1.1
Flush the entire ARP cache:
arp -a -d
Use Cases
- Troubleshooting network connectivity issues
- Monitoring network traffic
- Security auditing
Options
The following options are available for the arp command:
| Option | Description |
|---|---|
| -a | Display the contents of the ARP cache. |
| -d | Delete an entry from the ARP cache. |
| -s | Add an entry to the ARP cache. |
| -v | Verbose output. |
Troubleshooting Tips
- If an entry is not being added to the ARP cache, ensure that the IP address and MAC address are correct.
- If an entry is not being deleted from the ARP cache, ensure that the IP address is correct.
- If the ARP cache is not being displayed, ensure that there are entries in the cache.
Notes
- The ARP cache is used by the operating system to map IP addresses to MAC addresses.
- Entries in the ARP cache are automatically added and removed as devices join and leave the network.
- The ARP cache can be used to perform ARP spoofing attacks, so it is important to monitor the cache for suspicious entries.