Network Config

5. arp

Remember when we look up a MAC address with ARP, it first checks the locally stored ARP cache on our system. You can actually view this cache:

pete@icebox:~$ arp
Address                  HWtype  HWaddress           Flags Mask            Iface
192.168.22.1            ether   00:12:24:fc:12:cc   C                     eth0
192.168.22.254          ether   00:12:45:f2:84:64   C                     eth0

The ARP cache is actually empty when a machine boots up; it gets populated as packets are being sent to other hosts. If we send a packet to a destination that isn't in the ARP cache, the following happens:

  1. The source host creates the Ethernet frame with an ARP request packet.
  2. The source host broadcasts this frame to the entire network.
  3. If one of the hosts on the network knows the correct MAC address, it will send a reply packet and frame containing the MAC address.
  4. The source host adds the IP to MAC address mapping to the ARP cache and then proceeds with sending the packet.

You can also view your ARP cache via the ip command:

ip neighbour show

Sign in to save your learning progress

Sign in

Exercises

Practice makes perfect! Here are some hands-on labs to reinforce your understanding of ARP and network layer interaction:

  1. Explore Network Layer Interaction with ping and arp in Linux - Use ping and arp commands to observe how IP addresses are resolved to MAC addresses and how the default gateway handles traffic.
  2. Identify MAC and IP Addresses in Linux - Learn to use the ip a command to identify network addressing information, including MAC and IP addresses, which are fundamental to understanding ARP.
  3. Manage IP Addressing in Linux - Practice managing IP addressing using the ip command and verify network configuration with arp and traceroute.

These labs will help you apply the concepts of ARP and network addressing in real scenarios and build confidence with Linux networking.

Login to Practice on LabEx

Quiz

What command can you use to view your ARP cache?