arp - Network Config

Linux stores recently resolved next-hop link addresses in the neighbor table. For IPv4 over Ethernet, entries are learned through ARP; IPv6 uses Neighbor Discovery. The legacy arp command shows only part of this state, while ip neighbor handles both families.

Viewing Neighbor Entries

Inspect all entries or one interface:

$ ip neighbor show
$ ip neighbor show dev enp1s0

An entry includes an IP address, link-layer address, device, and reachability state. The table can be empty after boot and populate as traffic needs local next hops.

CheckWhich command displays modern Linux neighbor-table state?

Resolving an IPv4 Neighbor

When an on-link IPv4 mapping is absent, a host broadcasts an ARP request asking who owns the target address. The target, or a router explicitly performing proxy ARP, replies. The sender caches the mapping and transmits the waiting frame.

For a remote IP destination, the host resolves the selected gateway's address rather than the remote host's MAC.

CheckWhich IPv4 neighbor does a host resolve for an off-link destination?

Interpreting States

Common states include REACHABLE, STALE, DELAY, PROBE, INCOMPLETE, and FAILED. STALE means recent reachability confirmation has expired; the cached address can still be used while the stack probes as needed. FAILED indicates resolution or reachability detection did not succeed, but causes can include link, VLAN, address, route, filtering, or the peer being down.

CheckDoes STALE mean the neighbor is known to be unreachable?

Changing Neighbor State Carefully

Static entries and cache flushes are state-changing and can disrupt active traffic or hide the original evidence. Capture current routes, packet counters, and neighbor state first. Prefer a targeted probe and packet capture on an authorized test network before flushing an entire interface.

ARP has no built-in authentication, so duplicate addresses or spoofed replies can poison mappings. Switch protections, segmentation, monitoring, and higher-layer authentication help reduce impact.

CheckWhy avoid flushing the whole neighbor table as the first diagnostic step?

Summary

You can now inspect neighbor resolution without treating every cache state as failure.

Use ip neighbor for IPv4 and IPv6 state.
Resolve the destination only when it is on-link.
Resolve a gateway for off-link IP traffic.
Preserve cache evidence before targeted state changes.

Practice

In the practice terminal, run: ip neighbor show It prints the neighbor table - IP addresses mapped to MAC addresses. It may be short or empty.

ip neighbor covers IPv4 ARP and IPv6 Neighbor Discovery.