Linux command – arp , arping

ARP (Address Resolution Protocol) 地址解析協議,也就是你主機 NIC 使用的 MAC (固定不變) 和實際使用的 IP (會依據環境做改變) 相對應的列表.

測試環境為 CentOS 7 x86_64 虛擬機.

arp

當我們去 ping 未知的 IP 時.

[root@localhost ~]# arp
Address                  HWtype  HWaddress           Flags Mask            Iface
192.168.95.1             ether   00:50:56:c0:00:08   C                     ens33
192.168.95.254           ether   00:50:56:e9:ab:37   C                     ens33
gateway                  ether   00:50:56:fb:3e:c1   C                     ens33

[root@localhost ~]# ping 192.168.95.152
PING 192.168.95.152 (192.168.95.152) 56(84) bytes of data.
64 bytes from 192.168.95.152: icmp_seq=1 ttl=64 time=0.822 ms
64 bytes from 192.168.95.152: icmp_seq=2 ttl=64 time=1.12 ms
64 bytes from 192.168.95.152: icmp_seq=3 ttl=64 time=0.955 ms
^C
--- 192.168.95.152 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2006ms
rtt min/avg/max/mdev = 0.822/0.968/1.127/0.124 ms

透過 tcpdump 可以觀察到,系統透過 ARP 協定來詢問.

04:05:20.429250 ARP , Request who-has 192.168.95.152 tell localhost.localdomain length 28
04:05:20.430360 ARP , Replay 192.168.95.152 is-at 00:0C:29:eb:f1:61 (oui unknown) length 46

之後就會新增加一筆新的 IP 與 MAC 相對應的 ARP 清單.

[root@localhost ~]# arp
Address                  HWtype  HWaddress           Flags Mask            Iface
192.168.95.1             ether   00:50:56:c0:00:08   C                     ens33
192.168.95.254           ether   00:50:56:e9:ab:37   C                     ens33
gateway                  ether   00:50:56:fb:3e:c1   C                     ens33
192.168.95.152           ether   00:0c:29:eb:f1:61   C                     ens33

常用參數
-a : Use alternate BSD style output format (with no fixed columns).

[root@localhost ~]# arp -a
? (192.168.95.1) at 00:50:56:c0:00:08 [ether] on ens33
? (192.168.95.254) at 00:50:56:e9:ab:37 [ether] on ens33
gateway (192.168.95.2) at 00:50:56:fb:3e:c1 [ether] on ens33
? (192.168.95.152) at 00:0c:29:eb:f1:61 [ether] on ens33

-i If, –device If : Select an interface.

[root@localhost ~]# arp -i ens33
Address                  HWtype  HWaddress           Flags Mask            Iface
192.168.95.1             ether   00:50:56:c0:00:08   C                     ens33
192.168.95.254           ether   00:50:56:e9:ab:37   C                     ens33
gateway                  ether   00:50:56:fb:3e:c1   C                     ens33
192.168.95.152           ether   00:0c:29:eb:f1:61   C                     ens33

-d address : delete a ARP table entry.

[root@localhost ~]# arp -d 192.168.95.152
[root@localhost ~]# arp
Address                  HWtype  HWaddress           Flags Mask            Iface
192.168.95.1             ether   00:50:56:c0:00:08   C                     ens33
192.168.95.254           ether   00:50:56:e9:ab:37   C                     ens33
gateway                  ether   00:50:56:fb:3e:c1   C                     ens33

-s address : set up a new table entry.

[root@localhost ~]# arp -s 192.168.95.152 00:0c:29:eb:f1:61 
[root@localhost ~]# arp
Address                  HWtype  HWaddress           Flags Mask            Iface
192.168.95.1             ether   00:50:56:c0:00:08   C                     ens33
192.168.95.254           ether   00:50:56:e9:ab:37   C                     ens33
gateway                  ether   00:50:56:fb:3e:c1   C                     ens33
192.168.95.152           ether   00:0c:29:eb:f1:61   CM                    ens33

-f filename, –file filename : address info is taken from file filename.

arping

單存想知道某一 IP 所對應的 MAC 時可以使用.

[root@localhost ~]# arping -I ens33 192.168.95.152
ARPING 192.168.95.152 from 192.168.95.150 ens33
Unicast reply from 192.168.95.152 [00:0C:29:EB:F1:61]  1.122ms
Unicast reply from 192.168.95.152 [00:0C:29:EB:F1:61]  1.345ms
Unicast reply from 192.168.95.152 [00:0C:29:EB:F1:61]  1.586ms
Unicast reply from 192.168.95.152 [00:0C:29:EB:F1:61]  1.543ms
Unicast reply from 192.168.95.152 [00:0C:29:EB:F1:61]  1.766ms
^CSent 5 probes (1 broadcast(s))
Received 5 response(s)