2

I have some knowledge about arp command under linux which can help modify the ARP table. Now I want to temporarily affect ARP table(add, delete and change) entries without the help of arp.

For temporarily adding a new entry in ARP table, I can ping an unknown host and the a new pair for (new_host_ip, new_host_hw_addr) will be inserted into APR table.(correct me if this can not always complete the insertion).

My question is can I delete and change entries in ARP table without using arp directly just like the way inserting an ARP entry above?

Improve this question
2

No, you can't do it that easily. In fact, you can't even add an ARP entry and select its contents that way. To control the contents of an ARP entry or delete an ARP entry, you need root access and you need to create a NETLINK socket. See section 3.3 of RFC 3549.

Improve this answer
  • Does that mean the insertion described above is also invalid although I know the entry will expire several minutes later? – Summer_More_More_Tea Oct 8 '11 at 1:01
  • What do you mean by "invalid"? – David Schwartz Oct 8 '11 at 1:03
  • Maybe my question is not clear previously and sorry about that, have already updated.:) By 'invalid' I want to say I indeed temporarily affect the ARP table(insert a new entry) indirectly but it seems your opinion vary from the answer. – Summer_More_More_Tea Oct 8 '11 at 1:44
  • @Summer_More_More_Tea: You can't delete or change ARP entries as easily as you can induce the kernel to add them. Adding ARP replies to the ARP table is something the kernel normally does. Adding, deleting, or modifying beyond normal activity requires you to issue specific commands. Depending on the details of the reason you want to make these changes, there's probably a good way to do it. – David Schwartz Oct 8 '11 at 2:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.