Checking Address Resolution Protocol ARP

If you're not able to ping your gateway, you may have an issue at the Ethernet MAC layer. The Address Resolution Protocol (ARP) can be used to find information at the MAC layer. To view and configure ARP entries, use the arp or ip neighbor command. This example shows arp listing computers in the ARP cache by hostname:

# arp -v List ARP cache entries by name

Address HWtype HWaddress Flags Mask Iface ritchie ether 00:10:5A:AB:F6:A7 C eth0

einstein ether 00:0B:6A:02:EC:98 C eth0

Entries: 1 Skipped: 0 Found: 1

In this example, you can see the names of other computers that the local computer's ARP cache knows about and the associated hardware type and hardware address (MAC address) of each computer's NIC. You can disable name resolution to see those computers' IP addresses instead:

# arp -vn List ARP cache entries by IP address

Address HWtype HWaddress Flags Mask Iface

10.0.0.1 ether 00:10:5A:AB:F6:A7 C eth0

10.0.0.50 ether 00:0B:6A:02:EC:98 C eth0

Entries: 1 Skipped: 0 Found: 1

To delete an entry from the ARP cache, use the -d option:

# arp -d 10.0.0.50 Delete address 10.0.0.50 from ARP cache

Instead of just letting ARP dynamically learn about other systems, you can add static ARP entries to the cache using the -s option:

# arp -s 10.0.0.51 00:0B:6A:02:EC:95 Add IP and MAC addresses to ARP

To do the same actions with the ip command that you just did with the arp command, use the neighbor object (notice that neighbor, nei, and n objects can be used interchangeably):

# ip neighbor

10.0.0.1 dev eth0 lladdr 00:10:5a:ab:f6:a7 DELAY 10.0.0.50 dev eth0 lladdr 00:0b:6a:02:ec:98 REACHABLE

# ip n add 10.0.0.51 lladdr 00:0B:6A:02:EC:95 dev eth0

To query a subnet to see if an IP is already in use, and to find the MAC address of the device using it, use the arping command. The arping command is used by ifup to avoid IP conflicts when bringing an Ethernet NIC up. Here are examples:

# arping 10.0.0.50 Query subnet to see if 10.0.0.50 is in use ARPING 10.0.0.50 from 10.0.0.195 eth0

Unicast reply from 10.0.0.50 [00:0B:6A:02:EC:98] 0.694ms Unicast reply from 10.0.0.50 [00:0B:6A:02:EC:98] 0.683ms

# arping -I eth0 10.0.0.50 Specify interface to query from

Like the ping command, the arping command continuously queries for the address until the command is ended by typing Ctrl+c. Typically, you just want to know if the target is alive, so you can run one of the following commands:

# arping -f 10.0.0.50 Query 10.0.0.50 and stop at the first reply

# arping -c 2 10.0.0.51 Query 10.0.0.50 and stop after 2 counts

Continue reading here: Tracing Routes to Hosts

Was this article helpful?

+1 0