Variations on ARP
Various Plazes tools depend on the presence of the arp command in the OS to obtain the MAC address of the default gateway. And various implementations of arp return results in their own fashion. On this page I'm starting to assemble a list of variations on the output of arp to aid in developing a standard library of code that will allow all variations to be used.
Mac OS X, FreeBSD, OpenBSD
Usage:
usage: arp [-n] hostname arp [-n] -a arp -d hostname [pub] arp -d -a arp -s hostname ether_addr [temp] [pub] arp -S hostname ether_addr [temp] [pub] arp -f filename
Sample output, using the IP address of the default gateway:
# arp 192.168.1.1 ? (192.168.1.1) at 0:14:bf:8f:53:2d on en0 [ethernet]
# /usr/sbin/arp 216.86.77.194 grex (216.86.77.194) at 00:e0:18:d3:6f:3f on bge0 static
Sample output, showing entire arp cache:
arp -a ? (192.168.1.1) at 0:14:bf:8f:53:2d on en0 [ethernet] ? (192.168.1.97) at 0:e:c:59:46:c0 on en0 [ethernet] ? (192.168.1.255) at (incomplete) on en0 [ethernet] ? (192.168.129.201) at 40:0:1:0:0:1 on en1 [ethernet] ? (192.168.129.255) at ff:ff:ff:ff:ff:ff on en1 [ethernet]
Systems tested of this type (uname -a):
FreeBSD m-net.arbornet.org 4.6-RC FreeBSD 4.6-RC #0: Wed Nov 16 13:44:00 EST 2005 Darwin louise.local 8.4.0 Darwin Kernel Version 8.4.0: Tue Jan 3 18:22:10 PST 2006 OpenBSD grex.cyberspace.org 3.8 GENERIC#0 i386
Linux
Various
RedHat, Sharp Zaurus SL-5500, NSLU2 Linux
Usage:
Usage: arp [-vn] [<HW>] [-i <if>] [-a] [<hostname>] <-Display ARP cache arp [-v] [-i <if>] -d <hostname> [pub][nopub] <-Delete ARP entry arp [-vnD] [<HW>] [-i <if>] -f [<filename>] <-Add entry from file arp [-v] [<HW>] [-i <if>] -s <hostname> <hwaddr> [temp][nopub] <-Add entry arp [-v] [<HW>] [-i <if>] -s <hostname> <hwaddr> [netmask <nm>] pub <-''- arp [-v] [<HW>] [-i <if>] -Ds <hostname> <if> [netmask <nm>] pub <-''- -a display (all) hosts in alternative (BSD) style -e display (all) hosts in default (Linux) style -s, --set set a new ARP entry -d, --delete delete a specified entry -v, --verbose be verbose -n, --numeric don't resolve names -i, --device specify network interface (e.g. eth0) -D, --use-device read <hwaddr> from given device -A, -p, --protocol specify protocol family -f, --file read new entries from file or from /etc/ethers <HW>=Use '-H <hw>' to specify hardware address type. Default: ether List of possible hardware types (which support ARP): strip (Metricom Starmode IP) ash (Ash) ether (Ethernet) tr (16/4 Mbps Token Ring) tr (16/4 Mbps Token Ring (New)) ax25 (AMPR AX.25) netrom (AMPR NET/ROM) rose (AMPR ROSE) arcnet (ARCnet) dlci (Frame Relay DLCI) fddi (Fiber Distributed Data Interface) hippi (HIPPI) irda (IrLAP) x25 (generic X.25)
Sample output, using the IP address of the default gateway:
# arp 192.168.1.1 Address HWtype HWaddress Flags Mask Iface 192.168.1.1 ether 00:14:BF:8F:53:2D C eth0
Sample output, showing entire arp cache:
# arp -a ? (192.168.1.1) at 00:14:BF:8F:53:2D [ether] on eth0 ? (192.168.1.99) at 00:04:AC:E5:E1:2C [ether] on eth0 ? (192.168.1.150) at 00:03:93:BF:AE:8A [ether] on eth0 ? (192.168.1.98) at 00:0E:08:AA:FA:D5 [ether] on eth0
Systems tested of this type (uname -a):
Linux ross.reinvented.net 2.6.9-22.0.2.EL #1 Thu Jan 5 17:03:45 EST 2006 i686 i686 i386 GNU/Linux Linux wallis 2.4.20-13.8 #1 Mon May 12 12:20:54 EDT 2003 i686 i686 i386 GNU/Linux Linux zaurus 2.4.18-rmk7-pxa3-embedix #1 Fri, 9 May 2003 09:20:18 +0900 Linux edgar 2.4.22-xfs #1 Sun Jun 12 21:17:17 PDT 2005 armv5b unknown
OpenWRT
Sample output, showing entire arp cache:
# arp IP address HW type Flags HW address Mask Device 198.167.161.254 0x1 0x2 00:50:BA:BF:37:77 * vlan1 192.168.1.97 0x1 0x2 00:0E:0C:59:46:C0 * br0
Systems tested of this type:
BusyBox v1.00 (2005.11.23-21:46+0000) Built-in shell (ash) Linux nettie 2.4.30 #1 Wed Nov 23 22:35:53 CET 2005 mips unknown
Windows
Windows 2000
Usage:
Displays and modifies the IP-to-Physical address translation tables used by address resolution protocol (ARP). ARP -s inet_addr eth_addr [if_addr] ARP -d inet_addr [if_addr] ARP -a [inet_addr] [-N if_addr] -a Displays current ARP entries by interrogating the current protocol data. If inet_addr is specified, the IP and Physical addresses for only the specified computer are displayed. If more than one network interface uses ARP, entries for each ARP table are displayed. -g Same as -a. inet_addr Specifies an internet address. -N if_addr Displays the ARP entries for the network interface specified by if_addr. -d Deletes the host specified by inet_addr. inet_addr may be wildcarded with * to delete all hosts. -s Adds the host and associates the Internet address inet_addr with the Physical address eth_addr. The Physical address is given as 6 hexadecimal bytes separated by hyphens. The entry is permanent. eth_addr Specifies a physical address. if_addr If present, this specifies the Internet address of the interface whose address translation table should be modified. If not present, the first applicable interface will be used. Example: > arp -s 157.55.85.212 00-aa-00-62-c6-09 .... Adds a static entry. > arp -a .... Displays the arp table.
Sample output, using the IP address of the default gateway:
# arp -a 192.168.131.254 Interface: 192.168.131.65 on Interface 0x2 Internet Address Physical Address Type 192.168.131.254 00-00-0f-00-00-00 dynamic