A Beginners Guide to Address Resolution Protocols (ARP)

ARP locates the MAC address of a given IP address

Focused male engineer working at laptop
Hero Images / Getty Images

Address Resolution Protocols manage the way local IP addresses resolve between computers on a network.

The arp command isn't widely used—it's primarily useful only for specific forms of troubleshooting.

Imagine you have a computer such as a laptop and you want to communicate with your Raspberry Pi, which are both connected as part of your local broadband connection.

You can generally see if the Raspberry PI is available on the network by pinging it. As soon as you ping the Raspberry Pi or attempt any other connection with the Raspberry Pi, you will be kicking off the need for address resolution. Think of it as a form of handshake.

The ARP compares the address and subnet masks of the host and the target computer. If these match then the address has effectively been resolved to the local network.

So How Does This Process Actually Work?

Your computer uses an ARP cache, which is accessed first to resolve the address. If the cache does not contain the information required to resolve the address, then a request is sent to every machine on the network.

If a machine on the network doesn't list the IP address being searched for, then it will just ignore the request, but if the machine reports a match, then it adds the information for the calling computer to its own ARP cache. It then sends a response to the original calling computer.

Upon receiving confirmation of the target computer's address, the connection completes so a ping or other network request can follow.

The actual information the source computer is seeking from the destination computer is its MAC address.

Using the 'arp' Command

arp cache

By default, the arp command on Linux shows the hostname of the items within the ARP cache but you can force it to display IP addresses using the following switch:

arp -n

Alternatively, you might wish to use the following switch which will display the output in a different way:

arp -a

The output from the above command will be something along the lines of this:

raspberrypi (172.16.15.254) at d4:ca:6d:0e:d6:19 [ether] on wlp2s0

This time you get the computer's name, the IP address, the HW address, the HW type, and the network.

How to Delete Entries From the ARP Cache

The ARP cache doesn't hold on to its data for very long but if you cannot connect to a specific computer and you suspect the address data is incorrect, delete an entry from the cache in the following way.

First, run the arp command to get the HW address of the entry you wish to remove.

Now run the following command:

arp -d HWADDR

Replace HWADDR with the HW Address for the entry you wish to remove.