How to Inspect and Flush the Linux ARP and Neighbour Cache Using ip neigh

In local IPv4 and IPv6 computer networking, transmitting data to another host on the same physical broadcast domain requires mapping network layer IP addresses to data link layer Media Access Control (MAC) addresses. In IPv4, this resolution is managed by the Address Resolution Protocol (ARP), while IPv6 utilises Neighbor Discovery Protocol (NDP). When network interface hardware changes, IP address conflicts occur, or rogue gateway spoofing is suspected, the kernel’s cached IP-to-MAC associations must be inspected and refreshed. While the legacy arp command remains familiar to longtime users, modern Linux distributions manage ARP and NDP through the iproute2 suite’s ip neigh command.

Understanding the Linux Neighbour Table and State Machine

The Linux kernel maintains a dynamic neighbour table containing MAC addresses associated with adjacent network devices, such as local gateways, switches, and other servers. Unlike static tables, Linux neighbours transition through well-defined operational states defined in RFC 4861:

• REACHABLE: The neighbour’s MAC address is verified and packets were recently acknowledged as delivered within the reachability timeout.
• STALE: The MAC address is valid, but no traffic has been exchanged recently. The kernel continues using the address but queues a probe if new traffic begins.
• DELAY / PROBE: The kernel is actively transmitting unicast ARP requests or ICMPv6 Neighbour Solicitations to verify whether the device is still connected.
• INCOMPLETE: Address resolution is currently underway, but no response has yet been received.
• FAILED: The neighbour did not respond to resolution queries, indicating an invalid IP, offline host, or physical disconnection.
• PERMANENT: A static, manually configured entry that never expires or transitions through the dynamic probe state machine.

How to View the Active Neighbour and ARP Table

To inspect your Linux system’s active neighbour table, open your terminal and run:

ip neigh show

or the abbreviated shortcut:

ip n

The terminal outputs entries with their corresponding network interface, hardware MAC address, and state:

192.168.1.1 dev eth0 lladdr e4:38:83:12:34:56 REACHABLE
192.168.1.105 dev eth0 lladdr 50:eb:f6:78:9a:bc STALE
fe80::1 dev eth0 lladdr e4:38:83:12:34:56 router REACHABLE

Filtering Neighbour Queries by Interface and State

On high-density servers or hypervisor hosts managing hundreds of container veth pairs, the complete neighbour table can be extensive. You can filter the query to isolate specific segments.

Filtering by Network Interface

To view ARP entries associated strictly with a particular interface (such as eth0 or wlan0):

ip neigh show dev eth0

Filtering by State

To identify hosts that are currently failing resolution or have become unreachable, filter by state:

ip neigh show nud failed

(where nud stands for Neighbour Unreachability Detection).

How to Flush and Clear the ARP / Neighbour Cache

When a router or local server is replaced, its IP address remains identical, but its physical MAC address changes. If the Linux kernel retains the stale MAC address in cache, network traffic drops. Flushing the neighbour cache forces the kernel to immediately issue fresh broadcast ARP requests.

Flushing the Entire Neighbour Table Across All Interfaces

To purge every dynamic ARP and NDP entry on the system, run:

sudo ip neigh flush all

Flushing Entries for a Specific Interface

To clear the cache exclusively for a single adapter without disrupting other interfaces:

sudo ip neigh flush dev eth0

Flushing Entries in a Specific State

To purge only stale or failed records while leaving actively verified connections intact:

sudo ip neigh flush nud stale

Adding and Removing Static ARP Entries

In high-security environments or industrial networks where ARP spoofing (cache poisoning) must be mitigated, administrators can bind an IP address permanently to a specific hardware MAC address.

Adding a Permanent Entry

sudo ip neigh add 192.168.1.50 lladdr 00:11:22:33:44:55 nud permanent dev eth0

Confirm the entry by running ip neigh show 192.168.1.50. The state displays as PERMANENT, and the entry will not expire or change based on incoming broadcast packets.

Deleting an Entry

To remove a static or dynamic neighbour entry manually:

sudo ip neigh del 192.168.1.50 dev eth0

Mastering ip neigh provides systems engineers with immediate control over local link-layer diagnostics, eliminating lingering connectivity disruptions and hardening network communication across Linux environments.