ip neighbourneighbourARP Table Management

---

ip neighbour ” neighbour /ARP Table Management

The neighbour table objects establish bindings between protocol addresses and link layer addresses for hosts sharing the same physical link. neighbour object entries are organized into tables. The IPv4 neighbour object table is also known as the ARP table. These commands allow you to look at the neighbour table bindings and their properties, to add new neighbour table entries, and to delete old ones.

Abbreviations: neighbour, neighbor, neigh, n

To help with understanding the command flow, here is the output of ip neigh help:

 Usage: ip neigh {  add  del  change  replace }  {  ADDR [ lladdr LLADDR ]           [ nud {  permanent  noarp  stale  reachable }  ]            proxy ADDR }  [ dev DEV ]        ip neigh { showflush}  [ to PREFIX ] [ dev DEV ] [ nud STATE ] 

Arguments

add, a , change, chg, replace, repl, delete, del, d, flush, flu , and show (list)

The following commands create new neighbour records or update existing ones:

• ip neighbour add ” Add a new neighbour entry.

• ip neighbour change ” Change the existing entry.

• ip neighbour replace ” Add a new entry or change the existing entry.

All of the following modify these commands:

• to ADDRESS (default) ”The protocol address of the neighbour . It is either an IPv4 or an IPv6 address.

• dev NAME ”The interface to which this neighbour is attached.

• lladdr LLADDRESS ”The link layer address of the neighbour . LLADDRESS can be null.

• nud NUD_STATE ”The state of the neighbour entry. nud is an abbreviation for Neighbour Unreachability Detection. This state can take one of the following values:

  • permanent ” The neighbour entry is valid forever and can be removed only administratively.

  • noarp ” The neighbour entry is valid. No attempts to validate this entry will be made, but it can be removed when its lifetime expires .

  • reachable ” The neighbour entry is valid until reachability timeout expires.

  • stale ” The neighbour entry is valid, but suspicious. This option to ip neighbour does not change the neighbour state if the entry was valid and the address has not been changed by this command.

Examples

  ip neigh add 10.0.0.3 lladdr 000001 dev eth0 nud perm  

Add permanent ARP entry for neighbour 10.0.0.3 on the device eth0 .

  ip neigh chg 10.0.0.3 dev eth0 nud reachable  

Change its state to reachable .

ip neighbour delete ” Delete Neighbour Entry

This command invalidates a neighbour entry.

Abbreviations: delete, del, d

The arguments are the same as with ip neigh add , only lladdr and nud are ignored.

Example

To invalidate the ARP entry for neighbour 10.0.0.3 on the device eth0 .

  ip neigh del 10.0.0.3 dev eth0  

The deleted neighbour entry will not disappear from the tables immediately; if it is in use, it cannot be deleted until the last client releases it. Otherwise, it will be destroyed during the next garbage collection.

Attempts to delete or to change manually a NOARP entry created by the kernel may result in unpredictable behavior. More specifically , the kernel may start trying to resolve this address even on NOARP interfaces or change the address to multicast or broadcast.

ip neighbour show ” List Neighbour Entries

This command displays neighbour tables.

Abbreviations: show, list, sh, ls

Arguments

These options select the entries to be displayed from the ARP table:

• to ADDRESS (default) ”Prefix selecting neighbour s to list.

• dev NAME ”List only neighbour s attached to this device.

• unused ” List only neighbour s that are not in use now.

• nud NUD_STATE ”List only neighbour entries in this state. NUD_STATE takes values listed after the example or the special value all , which means all the states. This option may occur more than once. If this option is absent, ip lists all the entries except for none and noarp .

Example

 kuznet@alisa~ $  ip neigh ls  dev lo lladdr 00:00:00:00:00:00 nud noarp fe80::200:cff:fe76:3f85 dev eth0 lladdr 00:00:0c:76:3f:85 router }     nud stale 0.0.0.0 dev lo lladdr 00:00:00:00:00:00 nud noarp 193.233.7.254 dev eth0 lladdr 00:00:0c:76:3f:85 nud reachable 193.233.7.85 dev eth0 lladdr 00:e0:1e:63:39:00 nud stale kuznet@alisa~ $ 

The first word of each line is the protocol address of the neighbour , followed by the device name. The rest of the line describes the contents of the neighbour entry identified by the pair ( device, address ).

lladdr is the link layer address of the neighbour .

nud is the state of Neighbour Unreachability Detection for this entry. The full list of the possible NUD states with minimal descriptions follows :

• none ” The state of the neighbour is void.

• incomplete ” The neighbour is in process of resolution.

• reachable ” The neighbour is valid and apparently reachable.

• stale ” The neighbour is valid, but probably it is already unreachable, so the kernel will try to check it at the first transmission.

• delay ” A packet has been sent to the stale neighbour , and the kernel waits for confirmation.

• probe ” The delay timer has expired , but no confirmation was received. The kernel has started to probe neighbour with ARP/NDISC messages.

• failed ” Resolution has failed.

• noarp ” The neighbour is valid, and no attempt to check the entry will be made.

• permanent ” This is a noarp entry, but only the administrator can remove the entry from the neighbour table.

• A link layer address is valid in all the states except for none, failed , and incomplete .

IPv6 neighbour s can be marked with the router flag, which means that that neighbour introduced itself as an IPv6 router.

Option -statistics provides some usage statistics:

 kuznet@alisa~ $  ip -s n ls 193.233.7.254  193.233.7.254 dev eth0 lladdr 00:00:0c:76:3f:85 ref 5 used 12/13/20 }     nud reachable kuznet@alisa~ $ 

Here, ref is the number of users of this entry and used is a triplet of time intervals in seconds, separated by slashes . The triplet of numbers is coded as used/confirmed/updated . In this example they show that

The entry was used 12 seconds ago.

The entry was confirmed 13 seconds ago.

The entry was updated 20 seconds ago.

ip neighbour flush ” Flush Neighbour Entries

This command flushes the neighbour tables. Entries may be selected to flush by various criteria.

Abbreviations: flush, f

This command has the same arguments as show . Note that it will not run when no arguments are given, and that the default neighbour states to be flushed do not include permanent or noarp .

With the option -statistics the command becomes verbose and prints out the number of deleted neighbour s and number of rounds made in flushing the neighbour table. If the option is given twice, ip neigh flush also dumps all the deleted neighbour s in the format described in the previous subsection as in the following example:

 netadm@alisa~ #  ip -s -s n f 193.233.7.254  193.233.7.254 dev eth0 lladdr 00:00:0c:76:3f:85 ref 5 used 12/13/20 }     nud reachable ***Round 1, deleting 1 entries*** ***Flush is complete after 1 round*** 

---

Top