How to Use the arp Command to View the ARP Table in Linux

If you work with Linux, especially in networking, system administration, or troubleshooting, you’ll eventually run into the term “ARP”—and for a good reason. The Address Resolution Protocol (ARP) is foundational to how devices on any local area network (LAN) talk to each other. Whenever your computer, server, or even your phone wants to send data to another device on the same subnet, it uses ARP to figure out the hardware (MAC) address corresponding to an IP address.

You might think of ARP as the “address book” for your network. It records who’s who, so your device knows exactly where to send packets at the data link layer. If the ARP table breaks, network communication can grind to a halt, which is why being able to inspect, understand, and sometimes manipulate your ARP table is a core networking and troubleshooting skill.

In this guide, we’ll take a deep look at what ARP is, how the ARP table works in Linux, and—most importantly—how to use the arp command (and its modern alternatives) to view and interpret this crucial data. We’ll also explore real-world scenarios, security concerns, and best practices to give you not just the “how,” but also the “why” behind ARP management.

Understanding ARP: The Basics

What Is ARP and Why Do We Need It?

ARP stands for Address Resolution Protocol. On a TCP/IP network, devices communicate using IP addresses (like 192.168.1.5). But when it comes to actually sending a packet over Ethernet or Wi-Fi, that packet needs to be addressed to a MAC address—a unique hardware identifier burned into the network card.

So, how does your computer figure out the MAC address for a given IP? That’s ARP’s job. Here’s a typical workflow:

1. Your machine wants to send data to an IP address on the local network.
2. It checks its ARP table to see if it already knows the corresponding MAC address.
3. If not, it sends out an ARP broadcast: “Who has IP address X.X.X.X?”
4. The device with that IP responds with its MAC address.
5. Your machine updates its ARP table with this mapping and can now deliver packets directly to the correct hardware address.

The ARP table is a cache of recent IP-to-MAC address mappings. It’s constantly updated and pruned as your machine communicates with new devices and as old entries expire.

Why View the ARP Table?

Before diving into the arp command, let’s talk about why you’d want to view the ARP table in the first place:

• Troubleshooting: If you’re having issues reaching a device on your LAN, checking the ARP table can reveal if your system has the correct MAC address or is trying to talk to the wrong device.
• Network Discovery: Want to know what devices your system has seen or talked to? The ARP table is a quick peek at your local neighborhood.
• Security Auditing: ARP spoofing attacks (where a malicious device pretends to be another by hijacking its IP address) can be detected by keeping an eye out for duplicate or suspicious entries.
• General Curiosity: Sometimes, it’s just useful to see the under-the-hood mechanics of your network.

The ARP Table: What It Looks Like

The ARP table is essentially a list your computer keeps, mapping IP addresses to MAC addresses. Each row says, “If you want to talk to IP X, send your data to MAC address Y on interface Z.”

On Linux, this table is managed by the kernel and can be viewed and edited with various commands.

The arp Command: The Classic Tool

The arp command is a classic utility for displaying and modifying the ARP cache. It’s simple, direct, and available on most distributions, though some newer systems are moving to the ip suite of commands.

How to View the ARP Table

The most common usage is:

arp -a

This command displays the current ARP table in a readable format.

Sample Output

ubuntu-content-cache-1.ps5.canonical.com (185.125.190.96) at <incomplete> on wlo1
ubuntu-content-cache-2.ps6.canonical.com (91.189.91.97) at <incomplete> on wlo1
? (192.168.1.1) at b4:86:18:af:ef:ae [ether] on wlo1
is-content-cache-2.ps5.canonical.com (185.125.190.18) at <incomplete> on wlo1

This output shows various entries in the ARP table, with each line providing the following information:

• Hostname: The address of the device on your local network (e.g., ubuntu-content-cache-1.ps5.canonical.com).
• IP Address: The IP assigned to that device (e.g., 185.125.190.96).
• MAC Address: The hardware address of the device; in this case, it’s marked as <incomplete> for some entries, meaning the MAC address could not be resolved.
• Network Interface: Indicates the interface through which the communication is happening (e.g., wlo1).

Other Useful arp Command Options

View ARP Table for a Specific Interface

If you have multiple network interfaces (like Ethernet and Wi-Fi), you can filter by one:

arp -i eth0

or

arp -i wlo1

Get ARP Entry for a Specific IP Address

arp -a 192.168.1.1

Shows the ARP entry for just that IP, if present.

How to Populate the ARP Table

The ARP table is built dynamically. If you want to force your Linux system to learn about a device, simply try to communicate with it. The most common way is to ping it:

ping -c 1 192.168.1.1

After this, check the ARP table again (arp -a) and you should see an entry for the target device.

Adding and Deleting ARP Table Entries (Advanced)

Most users will only ever view the ARP table, but there are cases—especially in troubleshooting or special network configurations—where you might need to manually add or remove entries.

Add a Static ARP Entry

sudo arp -s 192.168.1.200 00:11:22:33:44:55

This tells your computer, “Always send data for 192.168.1.200 to MAC 00:11:22:33:44:55.”

Delete an ARP Entry

sudo arp -d 192.168.1.200

Warning: Manual entries are temporary—they’ll disappear after a reboot or network reset. For persistent changes, you’d need to script them or use advanced network configuration tools.

Understanding ARP Table Columns and Status

Let’s dissect a typical ARP table entry:

? (192.168.1.1) at 00:1a:2b:3c:4d:5e [ether] on eth0

• ?: Hostname (if resolvable) or placeholder
• (192.168.1.1): The IP address
• at 00:1a:2b:3c:4d:5e: The MAC address
• [ether]: The type (Ethernet hardware)
• on eth0: The network interface

If you see <incomplete>, it means your system hasn’t yet resolved that IP to a MAC (perhaps the device didn’t answer the ARP request).

Security: ARP Spoofing and Duplicate Entries

One reason to check the ARP table is to spot network anomalies:

• Duplicate IPs with different MACs: Could indicate someone accidentally (or maliciously) using the same IP, or a man-in-the-middle attack.
• Unknown or suspicious MAC addresses: Devices you don’t recognize might be on your network.
• Changing MAC addresses for the same IP: Could indicate ARP spoofing. If you see an IP flip between MAC addresses, investigate further.

Tip: For critical systems, consider using static ARP entries or robust DHCP and network monitoring to minimize risks.

Modern Alternatives: ip neigh

On some newer Linux systems, the arp command may not be installed by default, or you may see warnings that it’s deprecated. The modern replacement is:

ip neigh

Sample output:

192.168.1.1 dev eth0 lladdr 00:1a:2b:3c:4d:5e REACHABLE
192.168.1.101 dev eth0 lladdr 00:1b:2c:3d:4e:5f STALE
192.168.1.150 dev eth0 INCOMPLETE

• REACHABLE: Successfully contacted recently
• STALE: Not contacted recently, may need to re-resolve
• INCOMPLETE: No response to ARP request yet

The ip command is powerful and part of the iproute2 suite, which replaces many old networking tools.

Practical and Real-World Scenarios

1. Troubleshooting Connectivity

Suppose your Linux PC can’t communicate with a printer at 192.168.1.50. Run:

arp -a | grep 192.168.1.50

If there’s no entry, or it shows <incomplete>, the printer may be offline, or there’s a network issue.

2. Detecting Network Scans

If you suddenly see a flood of new MAC addresses in your ARP table, it could be a sign that someone is scanning your network.

3. Home Network Discovery

Just curious about what’s online? Ping your subnet, then check the ARP table:

for ip in 192.168.1.{1..254}; do ping -c 1 -W 1 $ip & done; sleep 5; arp -a

You’ll see a list of active devices that responded.

Frequently Asked Questions

Why is my ARP table empty?
If you haven’t communicated with other devices on your LAN since booting, your ARP table may be empty. Ping a few local IPs, and you should see entries appear.

Can I clear the ARP table?
Yes. On most systems, use:

sudo ip -s -s neigh flush all

How long are ARP entries kept?
ARP cache entries are held for a few minutes (the exact time is OS and kernel configurable). They are removed if the device goes offline or if your system restarts.

Do ARP entries get updated automatically?
Yes, as your device communicates or as devices reply to ARP requests, the table updates.

Troubleshooting ARP Issues

If you’re having persistent network problems, here’s a step-by-step approach using ARP:

1. Check the ARP Table: Run arp -a or ip neigh. Is the device you want to reach listed? Does the MAC address look right?
2. Ping the Device: If there’s no entry, try ping. If the device replies, its entry should appear.
3. Check for Duplicates: Look for multiple entries for the same IP or suspicious changes in MAC addresses.
4. Clear and Rebuild: If you suspect a stale ARP entry, clear the ARP cache (sudo ip -s -s neigh flush all) and try again.
5. Investigate Further: Use network tools like tcpdump or wireshark for deeper packet analysis if issues persist.

Conclusion

The ARP table is a small but vital piece of every networked Linux system. Being able to view, understand, and (occasionally) manage your ARP table using the arp command is a fundamental skill for troubleshooting, auditing, and maintaining efficient, secure networks.

While newer tools like ip neigh are taking over on modern systems, the basics remain the same: ARP is how your device knows where to send packets on the local network, and the ARP table is where those mappings live.

Key Takeaways:

• Use arp -a to view the ARP table on most systems.
• Use ip neigh for modern and more detailed output.
• Check the ARP table when troubleshooting connectivity or security issues.
• Know how to interpret, clear, and refresh ARP entries when needed.

Mastering ARP isn’t just for network engineers—it’s for anyone who wants to truly understand how Linux (and all computers) get your data where it needs to go.