arp Command
Intermediate Networking man(1)Manipulate the ARP cache
👁 9 views
📅 Updated: Mar 15, 2026
SYNTAX
arp [OPTION]... [HOSTNAME]
What Does arp Do?
arp displays and modifies the ARP (Address Resolution Protocol) cache. ARP maps IP addresses to MAC (hardware) addresses on the local network.
The ARP cache stores recently resolved IP-to-MAC mappings to avoid repeated ARP requests. Viewing the ARP table helps identify devices on the network and diagnose connectivity issues.
arp is part of the legacy net-tools package. The modern replacement is ip neigh (ip neighbour). Both provide similar functionality.
The ARP cache stores recently resolved IP-to-MAC mappings to avoid repeated ARP requests. Viewing the ARP table helps identify devices on the network and diagnose connectivity issues.
arp is part of the legacy net-tools package. The modern replacement is ip neigh (ip neighbour). Both provide similar functionality.
Options & Flags
| Option | Description | Example |
|---|---|---|
| -a | Show all entries | arp -a |
| -n | Numeric output (no DNS resolution) | arp -an |
| -d | Delete an entry | sudo arp -d 192.168.1.50 |
| -s | Set a static entry | sudo arp -s 192.168.1.50 aa:bb:cc:dd:ee:ff |
Practical Examples
#1 Show ARP table
Shows all known IP-to-MAC mappings.
$ arp -an
Output:
? (192.168.1.1) at aa:bb:cc:dd:ee:ff [ether] on eth0\n? (192.168.1.50) at 11:22:33:44:55:66 [ether] on eth0
#2 Modern equivalent
Shows neighbor table using the modern ip command.
$ ip neigh show
Output:
192.168.1.1 dev eth0 lladdr aa:bb:cc:dd:ee:ff REACHABLE
#3 Clear entry
Removes a specific ARP cache entry, forcing re-resolution.
$ sudo arp -d 192.168.1.50#4 Set static entry
Creates a permanent ARP mapping.
$ sudo arp -s 192.168.1.100 00:11:22:33:44:55Tips & Best Practices
Use ip neigh instead: ip neigh show is the modern replacement: ip neigh show, ip neigh add, ip neigh del.
Identify network devices: arp -an shows MAC addresses of devices you have communicated with. Useful for identifying devices on your network.
ARP spoofing: Static ARP entries (arp -s) can protect against ARP spoofing attacks on critical gateway addresses.
Frequently Asked Questions
How do I see MAC addresses on my network?
arp -an shows IP-to-MAC mappings for devices you have recently communicated with.
What is ARP?
ARP resolves IP addresses to MAC (hardware) addresses on the local network. Required for Ethernet communication.
How do I clear the ARP cache?
sudo arp -d IP removes one entry. sudo ip neigh flush all clears everything.
Related Commands
More Networking Commands
Master Linux with Professional eBooks
Curated IT eBooks covering Linux, DevOps, Cloud, and more
Browse Books →