— Address Resolution
The Address Resolution Protocol (ARP) is used to dynamically map between
Protocol Addresses (such as IP addresses) and Local Network Addresses (such as
Ethernet addresses). This implementation maps IP addresses to Ethernet,
ARCnet, or Token Ring addresses. It is used by all the Ethernet interface
ARP caches Internet-Ethernet address mappings. When an interface requests a
mapping for an address not in the cache, ARP queues the message which requires
the mapping and broadcasts a message on the associated network requesting the
address mapping. If a response is provided, the new mapping is cached and any
pending message is transmitted. ARP will queue at most one packet while
waiting for a response to a mapping request; only the most recently
``transmitted'' packet is kept. If the target host does not respond after
several requests, the host is considered to be down allowing an error to be
returned to transmission attempts. Further demand for this mapping causes ARP
request retransmissions, that are ratelimited to one packet per second. The
for a non-responding destination
for a non-responding router.
The ARP cache is stored in the system routing table as dynamically-created host
routes. The route to a directly-attached Ethernet network is installed as a
“cloning” route (one with the
flag set), causing routes to individual hosts on that network to be created on
demand. These routes time out periodically (normally 20 minutes after
validated; entries are not validated when not in use).
ARP entries may be added, deleted or changed with the arp(8)
utility. Manually-added entries may be temporary or permanent, and may be
“published”, in which case the system will respond to ARP requests
for that host as if it were the target of the request.
In the past, ARP was used to negotiate the use of a trailer encapsulation. This
is no longer supported.
ARP watches passively for hosts impersonating the local host (i.e., a host which
responds to an ARP mapping request for the local host's address).
Proxy ARP is a feature whereby the local host will respond to requests for
addresses other than itself, with its own address. Normally, proxy ARP in
is set up on a host-by-host basis using the
utility, by adding an entry for each host inside a
given subnet for which proxying of ARP requests is desired. However, the
“proxy all” feature causes the local host to act as a proxy for
hosts reachable through some other network interface,
different from the one the request came in from. It may be enabled by setting
The ARP protocol implements a number of configrable variables in
branch of the
- How long an ARP entry is held in the cache until it needs
to be refreshed.
- Number of retransmits before host is considered down and
error is returned.
- If an ARP entry is added for local address, force the
traffic to go through the loopback interface.
- Enables ARP proxying for all hosts on net.
- arp: %x:%x:%x:%x:%x:%x is using my IP
- ARP has discovered another host on the local network which
responds to mapping requests for its own Internet address with a different
Ethernet address, generally indicating that two hosts are attempting to
use the same Internet address.
- arp: link address is broadcast for IP
- ARP requested information for a host, and received an
answer indicating that the host's ethernet address is the ethernet
broadcast address. This indicates a misconfigured or broken device.
- arp: %d.%d.%d.%d moved from
%x:%x:%x:%x:%x:%x to %x:%x:%x:%x:%x:%x on %s
- ARP had a cached value for the ethernet address of the
referenced host, but received a reply indicating that the host is at a new
address. This can happen normally when host hardware addresses change, or
when a mobile node arrives or leaves the local subnet. It can also
indicate a problem with proxy ARP. This message can only be issued if the
sysctl net.link.ether.inet.log_arp_movements is set
to 1, which is the system's default behaviour.
- arpresolve: can't allocate llinfo for
- The route for the referenced host points to a device upon
which ARP is required, but ARP was unable to allocate a routing table
entry in which to store the host's MAC address. This usually points to a
misconfigured routing table. It can also occur if the kernel cannot
- arp: %d.%d.%d.%d is on if0 but got
reply from %x:%x:%x:%x:%x:%x on if1
- Physical connections exist to the same logical IP network
on both if0 and if1. It can also occur if an entry already exists in the
ARP cache for the IP address above, and the cable has been disconnected
from if0, then reconnected to if1. This message can only be issued if the
sysctl net.link.ether.inet.log_arp_wrong_iface is
set to 1, which is the system's default behaviour.
- arp: %x:%x:%x:%x:%x:%x attempts to
modify permanent entry for %d.%d.%d.%d on %s
- ARP has received an ARP reply that attempts to overwrite a
permanent entry in the local ARP table. This error will only be logged if
net.link.ether.inet.log_arp_permanent_modify is set
to 1, which is the system's default behaviour.
RFC826, An Ethernet Address Resolution
Leffler, S.J. and
Karels, M.J., RFC893,