ndd -get /dev/arp arp_cache_report

[S.C. Fun]

the above command will give output similar to this:

ifname proto addr proto mask hardware addr flags
lan0 150.150.007.010 255.255.255.255 00:10:83:b8:1b:cb
lan0 150.150.007.016 255.255.255.255 00:30:6e:2b:2c:06
lan0 150.150.007.025 255.255.255.255 00:30:6e:2c:85:8e PERM PUBLISH LOCAL
lan0 224.000.000.000 240.000.000.000 01:00:5e:00:00:00 PERM MAPPING

can anybody explain what is the following values mean:
1)PERM PUBLISH LOCAL
2)224.0.0.0 (why is it here?)
3)255.255.255.255 (why not showing the configured net mask of the Lan interface?)

thanks in advance.

[U.SivaKumar_2]

Hi,

PERM means that entry is a permanent one , it does not expire .

PUBLISH means that arp entry is for Proxy ARP.
which means this interface will answer ARP requests for the MAC address of some other interface or server which is LOCAL .

224.0.0.0 is the ARP entry for multicast support.
#ifconfig lan0


The 255.255.255.255 is not the net mask field in the ARP cache but like a filter.

It means that 150.150.7.25 is the ip to be matched for the MAC address table. In other words 255.255.255.255 means that ARP request
for IP 150.150.7.25 will only be answered with respective MAC address.

regards,
U.SivaKumar

[Ron Kinner]

Sivikumar is pretty much right about the first too. We disagree on the 3rd item.

1) just means this is your NIC. The other entries are for other devices on the LAN that it currently has in the ARP cache.

2) This is the multicast broadcast address range that all new NICs know to listen to.

3) IS the IP mask. A 255.255.255.255 mask indicates a single host and thus a single MAC. If you look at the entry for 224.0.0.0 you see that it has a mask of 240.0.0.0 which means that it is valid for 224.0.0.0 through 239.255.255.255 which is the multicast IP range and corresponds to a MAC of 01:00:5e:00:00:00 through 01:00:5e:7f:ff:ff. There is a slight mismatch here since bits 7 and 8 of the IP address (counting from the left) are not used when converting to the Multicast MAC.

Your machine is probably set up with a default route to the local router. If you did not have a default route to the local router but instead pointed the default route back to your PC then the NIC would ARP for every address and the local router would be expected to give a Proxy ARP reply where it sends its own MAC instead of the MAC of the device on the far end which it probably doesn't know. In this case your arp cache would be much more interesting and would contain lots of entries for devices on other networks (all strangely enough with the same MAC - that of the local router).

Ron