Home / ubuntu / Questions / 1497591
Accepted
Alex
Asked: 2023-12-20 15:44:39 +0800 CST

What does the `arp` command show?

  • 772

I googled and took a look at this page for example, and I know that the arp command is supposed to show the mapping between an Internet Protocol (IP) address and a Media Access Control (MAC) address.

But it does not make sense to me when I look at the output on a 22.04 ubuntu system. Here arp gives:

_gateway (192.168.107.172) at 3a:65:d4:6d:20:cf [ether] on wlp0s20f3

Here I would assume that there is an ethernet adapter with the MAC address 3a:65:d4:6d:20:cf which has the IP address 192.168.107.172. But when looking at ifconfig I do not see this IP address:

enp84s0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether 7c:57:58:80:1c:61  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device memory 0x54000000-540fffff  

enx00e04c680202: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.200.100  netmask 255.255.255.0  broadcast 192.168.200.255
        ether 00:e0:4c:68:02:02  txqueuelen 1000  (Ethernet)
        RX packets 124  bytes 11140 (11.1 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 28  bytes 2981 (2.9 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

enxa0cec8c97ebc: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether a0:ce:c8:c9:7e:bc  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 13849  bytes 1664000 (1.6 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 13849  bytes 1664000 (1.6 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlp0s20f3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.107.238  netmask 255.255.255.0  broadcast 192.168.107.255
        inet6 fe80::6a85:ef4a:7e3c:be96  prefixlen 64  scopeid 0x20<link>
        inet6 2a01:cb16:2068:7c6c:8e00:94e:c979:548e  prefixlen 64  scopeid 0x0<global>
        inet6 2a01:cb16:2068:7c6c:d2f4:5a68:7bd8:e5d7  prefixlen 64  scopeid 0x0<global>
        ether 3c:e9:f7:a7:1c:0f  txqueuelen 1000  (Ethernet)
        RX packets 209228  bytes 203369040 (203.3 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 113025  bytes 26069725 (26.0 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

I see that the adapter that was listed with arp ("wlp0s20f3") has the IP address 192.168.107.238 and not 192.168.107.172!

I also use an additional USB-Ethernet device ("enx00e04c680202") which does not show up in the arp list. Do USB-Ethernet adapters do not have a MAC address?

I check various pages HERE and HERE and HERE without answer...

networking

1 Answers

  1. Best Answer

    the ARP protocol is meant to give you the physical address of the DESTINATION card so your computer can physically connect with (not yours).

    _gateway (192.168.107.172) at 3a:65:d4:6d:20:cf [ether] on wlp0s20f3

    give you the information that your gateway that has the IP 192.168.107.172 has a macaddress of 3a:65:d4:6d:20:cf, so your card can ask to connect with or talk to.

    this is how it works :

    • ARP is used to map IP addresses to MAC addresses on a local area network. When a device knows the IP address of another device but needs to send frames to it at the MAC layer, ARP is used.
    • The device sends out an ARP request packet that is broadcast to all devices on the LAN. This packet contains the IP address that needs to be resolved to a MAC address.
    • The device with that IP address sends back an ARP reply containing its MAC address. This allows the requesting device to populate its ARP cache with a mapping of the IP address to MAC address.
    • ARP cache entries expire after a configurable timeout. Additional ARP requests are sent out as needed to keep the mappings up to date in the cache.

    So in summary, ARP provides the critical link between layer 3 (IP addresses) and layer 2 (MAC addresses) to allow devices to communicate directly on the local network segment.

    The command arp show you the distant macaddress of the others IP of your networks that your machine used not so long time ago.

    • 3