19

Where, in memory, does the ARP cache exist? I tried searching it up online but didn't find anything.

Improve this question
1
  • 1
    @Gilles So if I modify /proc/net/arp, then I would indirectly modify the ARP cache?
    – ssharma
    Nov 26, 2017 at 16:48

1 Answer 1

Reset to default
21

GNU/Linux, unlike MacOSx, uses the /proc directory structure, a.k.a. procfs, to store system data. The arp cache is located at /proc/net/arp You print the data to stdout directly from that system file via:

cat /proc/net/arp

I realized that you may also want the memory address that the kernel uses to find the arp cache. The exact address may vary. However, you can find the memory address table for all arp memory addresses the kernel uses in /proc/kallsyms

cat /proc/kallsyms |grep arp_

May be helpful as well.

Improve this answer
3
  • 6
    The /proc directory does not store anything. It displays things stored or computed by the kernel, and it sometimes allows modifying those things, but it does not correspond to any storage area. In the case of the ARP cache, you can view a text rendering of it through /proc/net/arp, but what you're seeing is some kernel data structures that have been pretty-printed, you are not directly seeing some file that constitutes the content of the cache.
    – Gilles 'SO- stop being evil'
    Nov 26, 2017 at 11:32
  • 6
    This is one place where “GNU/Linux” is wrong. You're referring to the kernel, the kernel is only called “Linux”.
    – Gilles 'SO- stop being evil'
    Nov 26, 2017 at 11:33
  • is it possible to modify /proc/net/arp ? I keep getting cat: write: Input/output error and echoing into it doesn't seem to change it. Is there another utility to change it? I cannot run arp or if in BusyBox v0.60.0
    – ComradeJoecool
    Jun 6, 2019 at 7:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .