clear arp-cache
Clears the entire ARP cache on the device, forcing the router to dynamically re-learn all ARP entries, typically used to resolve connectivity issues caused by stale or incorrect ARP mappings.
Definition: clear arp-cache is a Cisco IOS privileged exec command. Clears the entire ARP cache on the device, forcing the router to dynamically re-learn all ARP entries, typically used to resolve connectivity issues caused by stale or incorrect ARP mappings.
Overview
The `clear arp-cache` command is a powerful diagnostic and troubleshooting tool used in Cisco IOS to flush the entire Address Resolution Protocol (ARP) cache from a router or switch. ARP is a fundamental Layer 2 protocol that maps IP addresses (Layer 3) to MAC addresses (Layer 2) on a local network segment. Every Cisco device maintains an ARP table (or cache) that stores these mappings for a finite period (typically 4 hours by default).
Over time, entries can become stale due to network changes, device reboots, or misconfigurations, leading to connectivity issues such as unreachable hosts, packet drops, or asymmetric routing. The `clear arp-cache` command forces the device to delete all dynamic ARP entries (and optionally static entries if the `static` keyword is used) and rebuild the table by sending new ARP requests as traffic flows. This is often the first step in troubleshooting Layer 2 reachability problems, especially after a topology change, IP address reassignment, or when a host fails to respond despite being reachable via ping.
Unlike clearing the MAC address table (which affects Layer 2 forwarding), clearing the ARP cache directly impacts IP-to-MAC resolution, making it essential for scenarios involving proxy ARP, NAT, or VPN tunnels. The command is executed in privileged EXEC mode (enable) and does not affect the running configuration; it is a runtime operation. However, it can cause a brief disruption as the device re-learns ARP entries, which may impact latency-sensitive applications.
Alternatives include clearing a single entry with `clear arp <ip-address>` or using `clear ip arp` (which is synonymous on many platforms). In a broader workflow, network engineers typically verify the ARP cache with `show ip arp` before clearing, then re-check after to confirm re-learning. The command is also useful when testing ARP timeout settings or when deploying new devices that need to be immediately reachable without waiting for the default timeout.
It is important to note that clearing the ARP cache does not clear the MAC address table; those are separate constructs. In high-availability environments, clearing ARP on one device may cause temporary blackholing if the peer device still has stale entries. Therefore, it is often performed during maintenance windows or as part of a coordinated troubleshooting plan.
The command is available in all IOS versions, including IOS-XE, and behaves consistently across platforms, though output formatting may vary slightly. Understanding the ARP cache's role and how to manage it is critical for CCNA and CCNP candidates, as it directly impacts network performance and reliability.
clear arp-cacheWhen to Use This Command
- After changing the IP address of a directly connected device to ensure the router learns the new MAC-to-IP mapping.
- When troubleshooting intermittent connectivity issues suspected to be caused by a stale ARP entry pointing to a wrong MAC address.
- After replacing a faulty NIC or switch port on a directly connected host to force the router to discover the new MAC address.
- When implementing a security policy that requires periodic ARP cache flushing to prevent ARP spoofing attacks.
Command Examples
Clear entire ARP cache
clear arp-cacheRouter# Router#
The command executes without any output or confirmation. The ARP cache is cleared immediately. Use 'show arp' to verify that the cache is empty and entries are being re-learned.
Verify ARP cache after clearing
show arpProtocol Address Age (min) Hardware Addr Type Interface Internet 192.168.1.1 - 0001.0001.0001 ARPA GigabitEthernet0/0 Internet 192.168.1.2 0 0002.0002.0002 ARPA GigabitEthernet0/0 Internet 10.0.0.1 - 0003.0003.0003 ARPA GigabitEthernet0/1
After clearing, the ARP table shows only static entries (age '-') and dynamically learned entries with age '0' (just learned). The 'Hardware Addr' column shows MAC addresses. Dynamic entries will age out and be refreshed as traffic flows.
Understanding the Output
The 'clear arp-cache' command produces no output on successful execution. To verify the effect, use 'show arp'. The output of 'show arp' displays the ARP table with columns: Protocol (always Internet for IP), Address (IP address), Age (minutes since last learned; '-' means static), Hardware Addr (MAC address), Type (encapsulation type, typically ARPA for Ethernet), and Interface (outgoing interface).
After clearing, dynamic entries will have an age of 0 or will be absent until traffic triggers ARP requests. Static entries remain. A healthy network should show dynamic entries with low ages for active hosts.
Stale entries (high age) or incomplete entries (no MAC) indicate potential issues.
Configuration Scenarios
Clearing ARP Cache After a Router Replacement
A branch router (R2) was replaced with a new unit that has a different MAC address on its LAN interface. Hosts on the LAN (192.168.1.0/24) cannot reach the WAN gateway (10.0.12.1) because the upstream router (R1) still has the old MAC address in its ARP cache for 10.0.12.2.
Topology
R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2
R2(Gi0/1)---192.168.1.0/24---HostsSteps
- 1.Step 1: On R1, verify the current ARP entry for 10.0.12.2: R1# show ip arp 10.0.12.2
- 2.Step 2: Note the stale MAC address (e.g., 0011.2233.4455) that belongs to the old router.
- 3.Step 3: Clear the entire ARP cache on R1: R1# clear arp-cache
- 4.Step 4: Verify that the ARP entry for 10.0.12.2 is removed: R1# show ip arp 10.0.12.2 (should show - or incomplete)
- 5.Step 5: Initiate traffic from a host on 192.168.1.0/24 to a destination beyond R1 (e.g., ping 8.8.8.8). This triggers a new ARP request from R1 to R2.
- 6.Step 6: Confirm the new ARP entry with the correct MAC address: R1# show ip arp 10.0.12.2
! No configuration change needed; command is executed in privileged EXEC mode R1# clear arp-cache
Verify: R1# show ip arp 10.0.12.2 Protocol Address Age (min) Hardware Addr Type Interface Internet 10.0.12.2 0 aabb.cc00.0200 ARPA GigabitEthernet0/0
Watch out: If the new router's interface is not up/up, the ARP request will fail and the entry will remain incomplete. Ensure the link is operational before clearing.
Resolving Connectivity Issues Due to Stale ARP After VLAN Change
A server in VLAN 100 was moved to VLAN 200, but the switch (SW1) still has an ARP entry pointing to the old VLAN interface IP. Clients trying to reach the server via its IP (192.168.100.10) fail because the switch forwards traffic to the wrong VLAN.
Topology
SW1(Vlan100: 192.168.100.1)---Server (old: Vlan100, new: Vlan200)
SW1(Vlan200: 192.168.200.1)---Server (new IP: 192.168.200.10)Steps
- 1.Step 1: On SW1, check the ARP entry for the server's old IP: SW1# show ip arp 192.168.100.10
- 2.Step 2: Observe the MAC address and associated interface (likely Vlan100).
- 3.Step 3: Clear the ARP cache on SW1: SW1# clear arp-cache
- 4.Step 4: Verify the entry is removed: SW1# show ip arp 192.168.100.10 (should show -)
- 5.Step 5: From a client, ping the server's new IP (192.168.200.10) to trigger ARP resolution on the correct VLAN.
- 6.Step 6: Confirm the new ARP entry for the server's new IP: SW1# show ip arp 192.168.200.10
! No configuration change needed SW1# clear arp-cache
Verify: SW1# show ip arp 192.168.200.10 Protocol Address Age (min) Hardware Addr Type Interface Internet 192.168.200.10 0 aabb.cc00.0100 ARPA Vlan200
Watch out: Clearing the ARP cache on a switch also clears entries for all VLANs, which may cause temporary disruption for other hosts. Consider clearing only the specific entry with `clear arp 192.168.100.10` if possible.
Troubleshooting with This Command
The `clear arp-cache` command is a blunt instrument used when the ARP table is suspected to contain stale or incorrect entries. Healthy ARP output shows consistent mappings with age counters incrementing normally. Problem indicators include entries with an age of '-' (meaning the entry is incomplete or unresolved), entries pointing to incorrect MAC addresses (e.g., broadcast MACs like ffff.ffff.ffff), or entries that do not update after a topology change.
Common symptoms that warrant clearing the ARP cache include: intermittent connectivity to a specific host, inability to ping a device that is otherwise reachable, asymmetric routing where traffic goes out one path but returns via another, or after a device replacement where the MAC address changed. When troubleshooting, a network engineer should follow this step-by-step diagnostic flow: 1) Verify connectivity with ping or traceroute to identify the unreachable destination. 2) Check the ARP cache on the source device and any intermediate Layer 3 devices using `show ip arp <target-ip>`. 3) If the entry is missing or incomplete, check the target device's interface status and ensure it is up/up. 4) If the entry exists but is stale (e.g., old MAC), clear the ARP cache with `clear arp-cache` or clear the specific entry. 5) After clearing, immediately generate traffic to force ARP re-resolution (e.g., ping the target). 6) Re-verify the ARP entry to confirm it now shows the correct MAC and interface. 7) If the problem persists, check for Layer 1 issues, VLAN mismatches, or ACLs blocking ARP. Correlating `show ip arp` with `show mac address-table` can help identify if the MAC address is learned on the correct interface.
Additionally, `debug arp` can be used to monitor ARP requests and replies in real time, but caution is advised in production due to CPU impact. The `clear arp-cache` command is also useful when testing ARP timeout values; after changing `arp timeout` under an interface, clearing the cache forces the new timeout to take effect immediately. In summary, while clearing the entire ARP cache is a quick fix, it should be used judiciously and as part of a systematic troubleshooting approach.
CCNA Exam Tips
CCNA exam tip: 'clear arp-cache' is a privileged EXEC command; it cannot be run from global config mode.
CCNA exam tip: Clearing ARP cache does not affect static ARP entries; they remain until manually removed.
CCNA exam tip: The command is useful when troubleshooting connectivity after IP changes; it forces the router to send ARP requests again.
CCNA exam tip: Be aware that clearing ARP cache can cause temporary packet loss until entries are re-learned.
Common Mistakes
Mistake: Using 'clear arp-cache' in global configuration mode instead of privileged EXEC mode, resulting in '% Invalid input detected' error.
Mistake: Assuming the command clears only dynamic entries; it clears all entries including static ones (except those configured with 'arp' command).
Mistake: Forgetting to verify with 'show arp' after clearing, leading to confusion about whether the cache was actually cleared.
clear arp-cache vs clear mac address-table dynamic
The 'clear arp-cache' and 'clear mac address-table dynamic' commands both flush dynamically learned Layer 2 lookups, but they operate on different tables: the ARP cache maps IP addresses to MAC addresses, while the MAC address table maps MAC addresses to ports. They are commonly confused because both clear temporary forwarding information, yet serve distinct troubleshooting purposes.
| Aspect | clear arp-cache | clear mac address-table dynamic |
|---|---|---|
| Scope | All IPv4 ARP entries; IPv6 ND may be cleared separately | All dynamically learned MAC address entries (unicast only, not multicast) |
| Configuration mode | Privileged EXEC | Privileged EXEC |
| Persistence | Entries re-learned via ARP requests; no impact on config | Entries re-learned via frame forwarding; no impact on config |
| Precedence | Clears all ARP entries; static ARP entries remain | Clears all dynamic MAC entries; static, secure, and other sticky entries remain |
| Typical use | Resolve IP connectivity issues due to stale ARP mappings | Force switch to rediscover MAC locations after topology change |
Use clear arp-cache when a host is reachable from the router but ARP mappings are incorrect or stale, causing packet drops or misrouting.
Use clear mac address-table dynamic when a switch has stale MAC address entries that cause flooding or incorrect forwarding after a network change.
Platform Notes
In Cisco IOS-XE, the `clear arp-cache` command behaves identically to classic IOS, but the output of `show ip arp` may include additional fields such as 'Age' in minutes or seconds depending on the version. On NX-OS (Cisco Nexus switches), the equivalent command is `clear ip arp` (without the hyphen) or `clear ip arp <ip-address>` for a specific entry. NX-OS also supports `clear ip arp-cache` as an alias.
On Cisco ASA firewalls, the command is `clear arp` (without the cache suffix) and it clears the entire ARP table. In IOS-XR, the command is `clear arp-cache` as well, but it is available only in XR platforms that support ARP (e.g., ASR 9000). Note that in IOS-XR, the ARP cache is per-VRF, so clearing it affects only the default VRF unless a VRF is specified.
In older IOS versions (12.x), the command `clear arp-cache` also cleared the IP route cache on some platforms, but this is deprecated in modern IOS. In IOS 15.x and 16.x, the command strictly clears the ARP table. On Catalyst switches running IOS, the command is the same, but on switches running IOS-XE (like Catalyst 3650/9300), the behavior is identical.
Always verify the exact syntax with `?` in the CLI, as some platforms may offer additional keywords like `static` to clear only static entries. For CCNA/CCNP candidates, it is important to know that `clear arp-cache` is a privileged EXEC command and does not require configuration mode. There is no `no` form of this command.
The command is not saved to the running configuration; it is a runtime operation.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions