delete several permanent entries from arp table by command line

Question

I am trying to remove the permanent entries from my arp table. but the following command only removes those that are not permanent

ip -s -s neigh flush all

With the arp utility I was able to eliminate the permanent ones. Example:

arp -a
? (192.168.1.230) en d4:63:c6:11:22:33 [ether] PERM in enp2s0
arp -d 192.168.1.230

As there are several permanent entries I wanted to automate the command so that it removes any entry that contains "PERM":

arp -a | grep -i perm | grep -oP '(\d+\.){3}\d+' | xargs -I {} sudo arp -d {}

but it has an error:

xargs: sudo: ended with status 255; aborting

What did I do wrong? THK

Update:

solved bash to excluding the ip address of the computer where the command is executed

localip=192.168.1.11
arp -a | grep -i perm | grep -oP '(\d+\.){3}\d+' | grep -v $localip | xargs -I {} sudo arp -d {}

Thanks to all

Answer 1

Your system appears to be a Linux system.

Along the commands ifconfig, route and brctl, the arp is in the category of "obsolete commands": it's using the deprecated (for network) ioctl kernel API to interact with the network stack.

Newer commands and tools, respectively ip link and ip address, ip route, bridge and finally ip neighbour (to replace arp), are the newer versions, using instead the rtnetlink kernel API. New features (eg: policy routing with ip rule) are usually only available on the newer API.

The permanent entry in OP's example could have been added with this command:

ip neighbour add 192.168.1.230 lladdr d4:63:c6:11:22:33 nud permanent dev enp2s0

with nud meaning:

nud STATE
the state of the neighbour entry. nud is an abbreviation for 'Neighbour Unreachability Detection'. The state can take one of the following values:

permanent
the neighbour entry is valid forever and can be only be removed administratively.
[...]

These families of command have usually a more powerful syntax with some filter that can be applied to display or... bulk delete entries. Usually when a non-empty filter applies to the show subcommand (here: show permanent ARP entries):

# ip neighbour show nud permanent
192.168.1.230 dev enp2s0 lladdr d4:63:c6:11:22:33 PERMANENT

it will apply to the flush subcommand:

# ip neighbour flush nud permanent
# ip neighbour show nud permanent
#

---

Note:

While on my system arp is /usr/sbin/arp and I had this to rewrite the start with /usr/sbin/arp, your command appeared fine when run by a user with unlimited sudo rights. Anyway, if I understood your comment correctly, it underscores that trying to parse output mostly meant for human reading is not reliable.

---

UPDATE1: an example of controlled parsing with the JSON output

Recent enough iproute2 commands have a JSON output, which when combined with the jq JSON parsing command can help a lot if an application or script doesn't have a more direct API available.

Example to retrieve all IP addresses in the ARP table matching a locally administered MAC address or a Xen or a VMware OUI:

# ip -json neighbour | jq -r '.[] | if .lladdr != null and ( .lladdr | test("^(.[26ae]|00:16:3e|00:05:69|00:0c:29|00:1c:14|00:50:56)","xi") )  then .dst else empty end'

---

UPDATE2: as commented, how to add an entry already temporarily, so potentially randomly, present?

An entry already present, cannot be added. It can be changed (if the entry is known to exist) or replaced (change it if existing, add it if not existing, so this will never answer EEXIST). This works for many other commands of the iproute2 family.

Exemple:

# ping 192.168.1.231
PING 192.168.1.231 (192.168.1.231) 56(84) bytes of data.
From 192.168.1.2 icmp_seq=1 Destination Host Unreachable

[...]

# ip neigh show nud failed
192.168.1.231 dev enp2s0  FAILED
# ip neigh add 192.168.1.231 lladdr 12:34:56:78:ab:cd nud permanent dev enp2s0
RTNETLINK answers: File exists
# ip neigh replace 192.168.1.231 lladdr 12:34:56:78:ab:cd nud permanent dev enp2s0
# ip neigh show nud permanent
192.168.1.231 dev enp2s0 lladdr 12:34:56:78:ab:cd PERMANENT