Linux stores recently resolved next-hop link addresses in the neighbor table. For IPv4 over Ethernet, entries are learned through ARP; IPv6 uses Neighbor Discovery. The legacy arp command shows only part of this state, while ip neighbor handles both families.
Network Config · Lesson 5
arp
Learn how to inspect and interpret Linux IPv4 ARP and IPv6 neighbor-cache state.
Viewing Neighbor Entries
Inspect all entries or one interface:
$ ip neighbor show
$ ip neighbor show dev enp1s0
An entry includes an IP address, link-layer address, device, and reachability state. The table can be empty after boot and populate as traffic needs local next hops.
Which command displays modern Linux neighbor-table state?
Resolving an IPv4 Neighbor
When an on-link IPv4 mapping is absent, a host broadcasts an ARP request asking who owns the target address. The target, or a router explicitly performing proxy ARP, replies. The sender caches the mapping and transmits the waiting frame.
For a remote IP destination, the host resolves the selected gateway's address rather than the remote host's MAC.
Which IPv4 neighbor does a host resolve for an off-link destination?
Interpreting States
Common states include REACHABLE, STALE, DELAY, PROBE, INCOMPLETE, and FAILED. STALE means recent reachability confirmation has expired; the cached address can still be used while the stack probes as needed. FAILED indicates resolution or reachability detection did not succeed, but causes can include link, VLAN, address, route, filtering, or the peer being down.
Does STALE mean the neighbor is known to be unreachable?
Changing Neighbor State Carefully
Static entries and cache flushes are state-changing and can disrupt active traffic or hide the original evidence. Capture current routes, packet counters, and neighbor state first. Prefer a targeted probe and packet capture on an authorized test network before flushing an entire interface.
ARP has no built-in authentication, so duplicate addresses or spoofed replies can poison mappings. Switch protections, segmentation, monitoring, and higher-layer authentication help reduce impact.
Why avoid flushing the whole neighbor table as the first diagnostic step?
Lesson complete
You finished arp
You can now inspect neighbor resolution without treating every cache state as failure.
Use
ip neighborfor IPv4 and IPv6 state.Resolve the destination only when it is on-link.
Resolve a gateway for off-link IP traffic.
Preserve cache evidence before targeted state changes.
Keep your learning progress
Create a free account to save this lesson and continue learning on any device.
Create a free account