13

Both:

sudo ip -s -s neigh flush all

And:

sudo arp -d 192.168.0.102

Instead of clearing the arp cache they seem to just invalidate entries (they will appear as incomplete). Even after some minutes, the ARP cache looks like:

$ arp -n
Address                  HWtype  HWaddress           Flags Mask            Iface
192.168.0.103                    (incomplete)                              eth0
192.168.0.1              ether   DE:AD:BE:EF:DE:AD   C                     eth0

(The MAC of the gateway has been refreshed - that is ok)

How can I really clear the ARP cache, like in "delete all entries from the table"? I do not want to keep incomplete entries, I want them removed. Is this possible?

EDIT

This is my system:

» arp --version
net-tools 1.60
arp 1.88 (2001-04-04)
+I18N
AF: (inet) +UNIX +INET +INET6 +IPX +AX25 +NETROM +X25 +ATALK +ECONET +ROSE 
HW: (ether) +ETHER +ARC +SLIP +PPP +TUNNEL -TR +AX25 +NETROM +X25 +FR +ROSE +ASH +SIT +FDDI +HIPPI +HDLC/LAPB +EUI64 

» lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 14.04.2 LTS
Release:        14.04
Codename:       trusty

» uname -a
Linux polyphemus.xxx-net 3.13.0-46-generic #77-Ubuntu SMP Mon Mar 2 18:23:39 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

migrated from serverfault.com Mar 24 '15 at 22:16

This question came from our site for system and network administrators.

  • 3
    What are you trying to accomplish here? Or more clearly, what problem are you trying to solve? – EEAA Mar 18 '15 at 21:48
  • Are you short of arp table entries? Maybe there's a program asking for that IP, thus renewing that entry. Check with wireshark or tcpdump. – ott-- Mar 18 '15 at 21:56
  • 5
    @MichaelMartinez because xy problem. It seems likely that question isn't the root problem and there might be some underlying problem that the OP should be working on instead. – Zoredache Mar 18 '15 at 22:17
  • 1
    The reason why this information is not in the question is because it is not relevant. I want a clean ARP cache. Full stop. You do not trust me that I want that, but that is your problem, not mine. I assure you: I want a clean ARP cache. – dangonfast Mar 19 '15 at 6:44
  • 2
    There is an in-deep explanation of the ARP cache mechanism here: stackoverflow.com/a/15511117/647991 – dangonfast Mar 19 '15 at 9:59
12
ip link set arp off dev eth0 ; ip link set arp on dev eth0

Be sure to do it all at once, so you don't break network connectivity before you're able to turn ARP back on.

  • 2
    One must either do in a shell script or at the machine, as it seems to break the connectivity after the first command. – Louis Oct 19 '16 at 19:33
  • I did it on one line, and it worked: dev=eth2; ip link set arp off dev $dev; sleep 1; ip link set arp on dev $dev. The sleep may not be necessary. – mivk Jun 27 '17 at 16:31
5

Your first solution works, it just takes a little time (5-10 seconds in my test on Kali) to go from "(incomplete)" to no entries.

Presumably it is in some sort of transitional state on its way to being deleted.

  • For me (Ubuntu 14.04) this was not the case: the entries are kept for a long time (forever?) in the incomplete state. I will re-check this again today. – dangonfast Mar 19 '15 at 6:57
  • Verified: even after some minutes, the entries are still there, in the incomplete state (arp 1.88, net-tools 1.60) – dangonfast Mar 19 '15 at 7:28
  • Well then your issue is certainly non-standard behavior, maybe particular to Ubuntu 14.04. The correct way for doing it in Linux is just not working for you. Hope you find your answer soon. Can delete this one if you'd like. – armani Mar 19 '15 at 15:06
  • 1
    No, leave it, it gives info for others. But I guess that the more "standard" behavior is to be found in Ubuntu, not in Kali, which is a distro for penetration testing and has default values specifically tweaked for that use case. – dangonfast Mar 19 '15 at 15:15
1

In certain system, ip command is not available.

user@linux:~$ ip
-bash: ip: command not found
user@linux:~$

So this the alternative of the ip link set arp off dev eth0; ip link set arp on dev eth0 command.

If you want to delete all entries from the table in a single command, use for loop like the following example.

BEFORE

user@linux:~$ arp
? (10.0.0.1) at 00:00:00:aa:aa:12 [ether]  on eth1
? (172.168.0.3) at 00:00:00:aa:aa:11 [ether]  on eth2
user@linux:~$ 

REMOVING ARP WITH ARP -D COMMAND

user@linux:~$ for i in 10.0.0.1 172.168.0.3; do sudo arp -d $i; done
user@linux:~$

AFTER: MAC ADDRESS REMOVED FROM THE ENTRIES WITH INCOMPLETE MESSAGE

user@linux:~$ arp
? (10.0.0.1) at <incomplete>  on eth1
? (172.168.0.3) at <incomplete>  on eth2
user@linux:~$ 

That's true, by deleting arp with arp -d command, the arp entries are still there with incomplete message.

To solve this problem, use ifconfig ethx up/down like this

BEFORE

user@linux:~$ arp
? (10.0.0.1) at <incomplete>  on eth1
? (172.168.0.3) at <incomplete>  on eth2
user@linux:~$ 

DISABLE & ENABLE THE INTERFACES ETH1 & ETH2 IN A SINGLE COMMAND

user@linux:~$ for i in 1 2; do sudo ifconfig eth$i down; sudo ifconfig eth$i up; done
user@linux:~$ 

TADAAA ... PROBLEM SOLVED :)

user@linux:~$ arp
user@linux:~$ 
0

Your mentioned solution is the correct and safe approach to flush the ARP table:

ip neigh flush all [dev <device>]

If certain entries are changed into invalid, that's temporary and part of the ARP protocol. The important aspect is that the mapping is gone, an ARP entry flagged as incomplete is not an IP-MAC entry on the table.

I've just tried this and in my case it immediately cleared the table and left no incomplete entries.

  • In some (unclear) cases, ip neigh flush all is not sufficient. In my case it did not clear entries added with arp -s. – MappaM Feb 13 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.