arp

~10 min · arp, mac-address, lan-discovery

Level 0Pinger

0 XP0/101 lessons0/12 achievements

0/150 XP to next level150 XP to go0% complete

Inspecting the IP↔MAC table

arp shows and manipulates your local ARP cache — the kernel's mapping of IP addresses to MAC addresses on your LAN. Track 1 covered why ARP exists; this lesson is about using the command. The two practical uses: see which devices are on your LAN, and bust a stale entry when something feels off.

Discover devices via ping sweep + ARP

You can find every active device on your subnet by pinging the entire range (which populates ARP entries) and then dumping the ARP table. It's a poor man's nmap and entirely passive in terms of detection.

Code

ARP basics·bash

# Show the ARP table
arp -a
# Output:
#   ? (192.168.1.1) at aa:bb:cc:dd:ee:ff on en0 ifscope [ethernet]
#   ? (192.168.1.42) at 11:22:33:44:55:66 on en0 ifscope [ethernet]

# Force re-resolution (delete an entry, sudo required)
sudo arp -d 192.168.1.1

# Populate ARP for one host by pinging it first
ping -c 1 192.168.1.100 > /dev/null && arp -a | grep 192.168.1.100

Ping sweep + ARP for LAN inventory·bash

# Ping every IP on your /24 in parallel (populates ARP)
for i in $(seq 1 254); do
    ping -c 1 -W 1 192.168.1.$i > /dev/null 2>&1 &
done
wait

# Now read the ARP table
arp -a

External links

arp manual (BSD)

Exercise

Run the ping sweep + arp pattern from the second code block on your own /24. You should end up with an ARP table listing every device that responded to ping. Walk down the list — using the OUI lookup from Track 1, identify each device by manufacturer.

arp