1ARP(7) Linux Programmer's Manual ARP(7)
2
6 arp - Linux ARP kernel module.
7
9 This kernel protocol module implements the Address Resolution Protocol
10 defined in RFC 826. It is used to convert between Layer2 hardware
11 addresses and IPv4 protocol addresses on directly connected networks.
12 The user normally doesn't interact directly with this module except to
13 configure it; instead it provides a service for other protocols in the
14 kernel.
15 A user process can receive ARP packets by using packet(7) sockets.
17 There is also a mechanism for managing the ARP cache in user-space by
18 using netlink(7) sockets. The ARP table can also be controlled via
19 ioctl(2) on any PF_INET socket.
20 The ARP module maintains a cache of mappings between hardware addresses
22 and protocol addresses. The cache has a limited size so old and less
23 frequently used entries are garbage-collected. Entries which are
24 marked as permanent are never deleted by the garbage-collector. The
25 cache can be directly manipulated by the use of ioctls and its behav‐
26 iour can be tuned by the sysctls defined below.
27 When there is no positive feedback for an existing mapping after some
29 time (see the sysctls below) a neighbour cache entry is considered
30 stale. Positive feedback can be gotten from a higher layer; for exam‐
31 ple from a successful TCP ACK. Other protocols can signal forward
32 progress using the MSG_CONFIRM flag to sendmsg(2). When there is no
33 forward progress ARP tries to reprobe. It first tries to ask a local
34 arp daemon app_solicit times for an updated MAC address. If that fails
35 and an old MAC address is known an unicast probe is send ucast_solicit
36 times. If that fails too it will broadcast a new ARP request to the
37 network. Requests are only send when there is data queued for sending.
38 Linux will automatically add a non-permanent proxy arp entry when it
40 receives a request for an address it forwards to and proxy arp is
41 enabled on the receiving interface. When there is a reject route for
42 the target no proxy arp entry is added.
43
46 Three ioctls are available on all PF_INET sockets. They take a pointer
47 to a struct arpreq as their parameter.
48 struct arpreq {
50 struct sockaddr arp_pa; /* protocol address */
51 struct sockaddr arp_ha; /* hardware address */
52 int arp_flags; /* flags */
53 struct sockaddr arp_netmask; /* netmask of protocol address */
54 char arp_dev[16];
55 };
56 SIOCSARP, SIOCDARP and SIOCGARP respectively set, delete and get an ARP
58 mapping. Setting & deleting ARP maps are privileged operations and may
59 only be performed by a process with the CAP_NET_ADMIN capability or an
60 effective UID of 0.
61 arp_pa must be an AF_INET socket and arp_ha must have the same type as
63 the device which is specified in arp_dev. arp_dev is a zero-terminated
64 string which names a device.
65 ┌─────────────────────────────────────┐
68 │ arp_flags │
69 ├────────────────┬────────────────────┤
70 │flag │ meaning │
71 ├────────────────┼────────────────────┤
72 │ATF_COM │ Lookup complete │
73 ├────────────────┼────────────────────┤
74 │ATF_PERM │ Permanent entry │
75 ├────────────────┼────────────────────┤
76 │ATF_PUBL │ Publish entry │
77 ├────────────────┼────────────────────┤
78 │ATF_USETRAILERS │ Trailers requested │
79 ├────────────────┼────────────────────┤
80 │ATF_NETMASK │ Use a netmask │
81 ├────────────────┼────────────────────┤
82 │ATF_DONTPUB │ Don't answer │
83 └────────────────┴────────────────────┘
84 If the ATF_NETMASK flag is set, then arp_netmask should be valid.
86 Linux 2.2 does not support proxy network ARP entries, so this should be
87 set to 0xffffffff, or 0 to remove an existing proxy arp entry.
88 ATF_USETRAILERS is obsolete and should not be used.
89
92 ARP supports a sysctl interface to configure parameters on a global or
93 per-interface basis. The sysctls can be accessed by reading or writing
94 the /proc/sys/net/ipv4/neigh/*/* files or with the sysctl(2) interface.
95 Each interface in the system has its own directory in
96 /proc/sys/net/ipv4/neigh/. The setting in the `default' directory is
97 used for all newly created devices. Unless otherwise specified time
98 related sysctls are specified in seconds.
99 anycast_delay
101 The maximum number of jiffies to delay before replying to a IPv6
102 neighbour solicitation message. Anycast support is not yet
103 implemented. Defaults to 1 second.
104 app_solicit
106 The maximum number of probes to send to the user space ARP dae‐
107 mon via netlink before dropping back to multicast probes (see
108 mcast_solicit). Defaults to 0.
109 base_reachable_time
111 Once a neighbour has been found, the entry is considered to be
112 valid for at least a random value between base_reachable_time/2
113 and 3*base_reachable_time/2. An entry's validity will be
114 extended if it receives positive feedback from higher level pro‐
115 tocols. Defaults to 30 seconds.
116 delay_first_probe_time
118 Delay before first probe after it has been decided that a neigh‐
119 bour is stale. Defaults to 5 seconds.
120 gc_interval
122 How frequently the garbage collector for neighbour entries
123 should attempt to run. Defaults to 30 seconds.
124 gc_stale_time
126 Determines how often to check for stale neighbour entries. When
127 a neighbour entry is considered stale it is resolved again
128 before sending data to it. Defaults to 60 seconds.
129 gc_thresh1
131 The minimum number of entries to keep in the ARP cache. The
132 garbage collector will not run if there are fewer than this num‐
133 ber of entries in the cache. Defaults to 128.
134 gc_thresh2
136 The soft maximum number of entries to keep in the ARP cache.
137 The garbage collector will allow the number of entries to exceed
138 this for 5 seconds before collection will be performed.
139 Defaults to 512.
140 gc_thresh3
142 The hard maximum number of entries to keep in the ARP cache.
143 The garbage collector will always run if there are more than
144 this number of entries in the cache. Defaults to 1024.
145 locktime
147 The minimum number of jiffies to keep an ARP entry in the cache.
148 This prevents ARP cache thrashing if there is more than one
149 potential mapping (generally due to network misconfiguration).
150 Defaults to 1 second.
151 mcast_solicit
153 The maximum number of attempts to resolve an address by multi‐
154 cast/broadcast before marking the entry as unreachable.
155 Defaults to 3.
156 proxy_delay
158 When an ARP request for a known proxy-ARP address is received,
159 delay up to proxy_delay jiffies before replying. This is used
160 to prevent network flooding in some cases. Defaults to 0.8 sec‐
161 onds.
162 proxy_qlen
164 The maximum number of packets which may be queued to proxy-ARP
165 addresses. Defaults to 64.
166 retrans_time
168 The number of jiffies to delay before retransmitting a request.
169 Defaults to 1 second.
170 ucast_solicit
172 The maximum number of attempts to send unicast probes before
173 asking the ARP daemon (see app_solicit). Defaults to 3.
174 unres_qlen
176 The maximum number of packets which may be queued for each unre‐
177 solved address by other network layers. Defaults to 3.
178
181 Some timer settings are specified in jiffies, which is architecture
182 related. On the Alpha a jiffy is 1/1024 of a second, on most other
183 architectures it is 1/100s.
184 There is no way to signal positive feedback from user space. This
186 means connection oriented protocols implemented in user space will gen‐
187 erate excessive ARP traffic, because ndisc will regularly reprobe the
188 MAC address. The same problem applies for some kernel protocols (e.g.
189 NFS over UDP).
190 This man page mashes IPv4 specific and shared between IPv4 and IPv6
192 functionality together.
193
196 The struct arpreq changed in Linux 2.0 to include the arp_dev member
197 and the ioctl numbers changed at the same time. Support for the old
198 ioctls was dropped in Linux 2.2.
199 Support for proxy arp entries for networks (netmask not equal
201 0xffffffff) was dropped in Linux 2.2. It is replaced by automatic proxy
202 arp setup by the kernel for all reachable hosts on other interfaces
203 (when forwarding and proxy arp is enabled for the interface).
204 The neigh/* sysctls did not exist before Linux 2.2.
206
209 capabilities(7), ip(7)
210 RFC 826 for a description of ARP.
212 RFC 2461 for a description of IPv6 neighbour discovery and the base
213 algorithms used.
214 Linux 2.2+ IPv4 ARP uses the IPv6 algorithms when applicable.
216Linux Man Page 1999-06-03 ARP(7)