Let me preface this by saying that I am relatively new to networking so please forgive my ignorance and correct any errors in my thinking, gaps in my knowledge, or incorrect assumptions.

I'm experimenting with setting static arp cache entries on Linux and using tcpdump/Wireshark to monitor the traffic and have noticed something strange. Normally, when I create an entry for a given IP address and then ping that IP, I don't see any outgoing ARP requests, which I expect is because the MAC address is being determined from my local cache.

However this is not true for the IP address of the gateway. Specifically, when I create an ARP entry for the IP address of the gateway/router, and then join the network, I see outgoing arp requests from my machine inquiring about the MAC address of the gateway. It's like my ARP cache is being ignored/bypassed. Why is this? Or am I not understanding something?

The command I have used to create ARP entries is:

sudo arp -s 00:0c:29:c0:94:bf

I have also tried

sudo ip n replace dev wlan0 to lladdrr 00:0c:29:c0:94:bf

UPDATE: I am also seeing this behavior on OSX. The command I am using there to create new arp entries is:

sudo arp -S 00:0c:29:c0:94:bf ifscope en0
  • 2
    Are you using NetworkManger? If yes disable it. – GAD3R Aug 8 '17 at 17:30
  • 1
    What is the output of ip neigh? – Hauke Laging Aug 8 '17 at 19:02
  • @GAD3R why, does NetworkManager ignore the ARP cache? – Mathew Marcus Aug 8 '17 at 20:31
  • What does it have to do with network manager? – ysdx Aug 8 '17 at 21:08
  • 1
    @MathewMarcus: could you show your routing table? – ysdx Aug 8 '17 at 21:08

You need

ip neigh replace dev wlan0 to lladdrr 00:0c:29:c0:94:bf nud permanent

in order to set an entry permanently.

I cannot reproduce the effect you describe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.