Command by command
| Cisco IOS | Linux | What it gives you |
|---|---|---|
show arp | ip neigh show | The full neighbour table |
show ip arp 10.0.1.5 | ip neigh show 10.0.1.5 | One entry |
clear arp-cache | ip neigh flush all | Drop every entry |
clear arp 10.0.1.5 | ip neigh del 10.0.1.5 dev ge0 | Drop one entry |
| ip -s neigh show | With usage statistics |
What the output looks like
$ ip neigh show
10.0.1.2 dev ge0 lladdr 02:42:0a:00:01:02 REACHABLE
10.0.1.5 dev ge0 lladdr 02:42:0a:00:01:05 STALE
10.0.1.9 dev ge0 FAILEDWhy the two differ
Cisco's ARP table is essentially a cache with an age counter. Linux implements a full neighbour state machine, and the state is the diagnostic. REACHABLE means confirmed recently. STALE means the entry is old but still usable — Linux will verify it on next use rather than discarding it, so STALE is normal and not a problem. FAILED means ARP resolution was attempted and nothing answered, which is the state that actually indicates a fault. INCOMPLETE means resolution is in progress right now.
The trap
A missing entry is not evidence of a problem. Linux populates the neighbour table lazily, so a host you have not talked to recently simply will not appear. Ping it first, then look again. People chase phantom ARP faults because they read an empty table as a failure.
Common questions
What is the difference between the ARP table and the MAC address table?
The ARP table maps IP addresses to MAC addresses and lives on anything doing layer 3. The MAC address table maps MAC addresses to switch ports and lives on a switch. They answer different questions: "who has this IP" versus "which port is this MAC behind".
Why does an entry show FAILED when the host is up?
ARP requests are broadcast, so the usual causes are a VLAN mismatch putting the two hosts in different broadcast domains, or a firewall on the target dropping ARP. Confirm both interfaces are in the same subnet and VLAN before suspecting the host.
Stop reading, start running
Open the lab, go live, and run ip neigh show against real Linux networking in your browser. No install, no signup.