arp -- Address Resolution Protocol display and control

Dynamically maps between IP addresses and Ethernet addresses, via a cache.

-a all
arp -a
? ( at (incomplete) on en1 [ethernet] dynamically asigned
rtr.germans ( at 0:18:1:8f:23:ed on en1 ifscope [ethernet]
? ( at 0:1b:21:a4:32:bd on en1 ifscope [ethernet]
dgermans-ipad.germans ( at 18:20:32:9f:54:75 on en1 ifscope [ethernet]
? ( at 0:1b:dd:28:fc:4d on en1 ifscope [ethernet]
? ( at 0:1f:c4:ef:5d:f1 on en1 ifscope [ethernet]
The DNS server is queried to display hostnames.
If response is slow it may be the DNS server is the problem.
host displays the Internet-to-Ethernet address
arp rtr
rtr.germans ( at 0:18:1:8f:23:ed on en1 ifscope [ethernet] 
The host may be specified by name or by number, using Internet dot notation.
-llink-layer reachability information (no IP address unless -n then no name)
arp -al 
Neighbor                Linklayer Address Expire(O) Expire(I)    Netif Refs Prbs
rtr.germans             0:7f:28:cc:a9:f1  10s       10s            en1    1
slammerfox.germans      0:1e:2a:d0:5:1a   expired   expired        en1    1           ff:ff:ff:ff:ff:ff (none)    (none)         en1
-xextended link-layer reachability(no IP address unless -n then no name)
arp -ax
Neighbor                Linklayer Address Expire(O) Expire(I)    Netif Refs Prbs RSSI    LQM     NPM
rtr.germans             0:7f:28:cc:a9:f1  54s       54s            en0    1 none unknown unknown unknown
denniss-ipad.gmans      (incomplete)      1m39s     expired        en0    1    6 unknown unknown unknown
marilynssiphone.gmans   (incomplete)      1m55s     expired        en0    1    5 unknown unknown unknown
kitchen.gmans           e0:69:95:7:7e:be  1m14s     1m44s          en0    1 none unknown unknown unknown 
ip-stb1                 0:1f:c4:ef:5d:f1  expired   2m23s          en0    1 none unknown unknown unknown

-nNo queries to DNS server (much faster)
-i exxxInterface exx is the only one included in the display
-d [host] [ifscope enn]

-d -a
delete host's entry
its PUBlished entry
its entry for enn

Delete all entries (not bad as entries created dynamically will be recreated as needed.
Manually added entries are discarded.

-s host auto|Eaddr
[ifscope enn]]
[pub only ]


-S delete existing entry first

set an entry
auto | Eaddr MAC_addr: six hex bytes separated by colons(ex 00:0A:97:01:FC:12 ).
pub : the entry will be "published"; i.e., this system will act as an arp server, responding to ARP requests for host even though the host address is not its own.
pub only: published (proxy only)
reject: traffic to host will be discarded and the unreachable error returned
blackhole: host will be flagged as unavailable and NO error returned

-f file file to be read and multiple entries to be set.
Entries of the form:
host MAC_addr [temp] [pub]

See also

inet(3), ifconfig

arp(4) When an interface requests a mapping for an address not in cache, that message is queued and
a broadcasts on the associated network requesting the address mapping is sent.
If a response is provided, the new mapping is cached and any pending message is transmitted.
If no response is recieved after several requests, the host is considered to be down for a short period (Default 20 seconds), and the EHOSTDOWN error is reported for host, and EHOSTUNREACH for a router.

The cache is stored in the system routing table as dynamically-created host routes.
The route to a directly-attached Ethernet network is installed as a cloning route (one with the RTF_CLONING flag set), causing routes to individual hosts on that network to be created on demand.
Routes time out periodically (Default 20 minutes after validated;). An entry for a host which is not responding is a reject route (one with the RTF_REJECT flag set).

Entries may be added, deleted or changed with the arp utility.
Manually-added entries may be temporary or permanent,
and may be published, in which case THIS system will respond to ARP requests for that target host.

ARP watches passively for hosts impersonating the local host (i.e. a host which responds to an ARP mapping request for the local host's address).


EHOSTUNREACH router. is nresponsive!

duplicate IP address %x!! sent from ethernet address: %x:%x:%x:%x:%x:%x.
another host on the local network which responds to mapping requests for its own IP address with a different Ethernet address, generally indicating that two hosts are attempting to use the same IP address.