In this demonstration,
I will use Ubuntu Linux to cover some of the basics of ARP cache management.
You will learn the commands to view your ARP cache,
as well as how to gather the Mac and IP addressing
information for systems within your LAN.
You will learn to add and remove single static and dynamic
entries and multiple ways to clear your ARP cache.
To start,
I'll open a command terminal and issue the ifconfig
command to gather the local systems IP, MAC address,
and network card designation.
Entering the ARP command will show the cache.
Within, you can see the IP addresses of LAN systems.
The hardware type of ether refers to the ethernet type of physical
network and addressing used in the hardware address column.
The flag section has the code C,
these are complete and current entries dynamically learned.
And finally,
the Iface column lets us know on which interfaces ARP entries were learned.
To add dynamic entries into the ARP cache,
simply ping a live system on the LAN and check the ARP cache.
I like the -c 1 option as all we need to do is generate one ping,
which will force an ARP request and reply and
creates the desired ARP cache entry.
To clear a single dynamic entry, we can use the arp -d command,
however, as this requires elevation, we need to proceed the command with sudo.
You'll notice that the cleared ARP cache entry now shows as
incomplete and will no longer be used for forwarding data.
If we want to add static entries, again,
we need to elevate the arp -s command with sudo.
Here, I'll add an ARP cache entry for server at 20.
1.
75 with the MAC address aa:bb:cc:dd:ee.
Notice that now this shows in my ARP cache with the flag C as complete,
but m also meaning a permanent static entry.
Deleting a static entry uses the same command,
sudo arp -d, and the IP address of the entry we wish to delete.
Clearing all dynamic entries can be done in one of three ways.
First, we can use the IP neighbor command,
another command often used to view and affect ARP information,
to force a flush of our ARP cache with the -s added to give statistical output.
Huh, of course, it works a lot better if you actually add the ip.
Note,
we still see static and dynamic entries cleared from
the ARP cache listed as incomplete.
These incomplete entries will be cleared from the cache in due
time and are not used for forwarding data.
If you wish these incomplete entries cleared,
you can either wait for the appropriate system process to clear
them out or you can take more drastic measures by either
stopping and starting the ARP on an interface with sudo ip link
set arp off for device ens33, my network card.
Then to bring it back on, we'll just change the off to an on,
this will clear the ARP cache.
Also,
you could use sudo ifconfig ens33 down to bring the network card down and
change the down to up to bring the network card back up,
this will also clear ARP caches.
Finally, a note about changing ARP cache timers.
ARP cache timers within Linux based operating systems varies heavily
based on the flavor and is not straightforward.
To effectively control and change ARP timers,
it requires editing ARP and non-ARP based process timers
within the exe system CTL Cont file.
Altering this can have impacts on how the Linux,
kernel, and other processes within Linux handled data. Due to the associated risks, I will not be demonstrating this for Linux.