Inspect and edit the IPv4 ARP cache to resolve IP addresses to hardware MAC addresses quickly. 19.02.2026 | reading time: 2 min On Linux the `arp` command lets the user view and manipulate the system's IPv4 ARP cache, linking IPv4 addresses to Ethernet MAC addresses; it is a practical tool for troubleshooting local network reachability and layer‑2 problems. A quick hands-on case Imagine a lab host at 192.168.10.20 does not respond to a service check; check ARP after a single ping to see the MAC mapping and cache entry: ``` $ ping -c 1 192.168.10.20 PING 192.168.10.20 (192.168.10.20) 56(84) bytes of data. 64 bytes from 192.168.10.20: icmp_seq=1 ttl=64 time=0.123 ms --- 192.168.10.20 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss $ arp -n Address HWtype HWaddress Flags Mask Iface 192.168.10.20 ether aa:bb:cc:dd:ee:01 C eth0 ``` Change and clean entries Do things: add a static mapping with `sudo arp -s 192.168.10.50 00:11:22:33:44:55`, remove an entry with `sudo arp -d 192.168.10.50` and view numeric output with `arp -n`; use `-i` to bind to an interface and watch for "incomplete" entries which mean no ARP reply arrived. When arp is not enough `arp` comes from net-tools and is limited; use `ip neigh` as the modern replacement, `arping` to test ARP replies directly, and `tcpdump` to inspect ARP broadcasts and spot spoofing or unexpected traffic on the wire. Wrap and next steps Mastering ARP gives clear visibility into who is reachable on the LAN and why; practice adding, deleting and observing entries, then expand to packet captures and neighbor discovery for IPv6—consider preparing for a certification such as CompTIA Linux+ or LPIC-1 with intensive exam training at bitsandbytes.academy to deepen Linux networking skills. Join Bits & Bytes Academy First class LINUX exam preparation. network utilities troubleshooting
