Courseiva
Layer 2Privileged EXEC

show ip arp

Displays the Address Resolution Protocol (ARP) cache, mapping IP addresses to MAC addresses on a router or switch, used to verify connectivity and troubleshoot Layer 2 issues.

Syntax·Privileged EXEC
show ip arp

When to Use This Command

  • Verify that a router has resolved the MAC address of a next-hop gateway for a remote network.
  • Troubleshoot connectivity issues by checking if an ARP entry exists for a specific IP address.
  • Identify duplicate IP addresses by looking for incomplete or inconsistent ARP entries.
  • Monitor ARP cache aging and clear stale entries when network changes occur.

Command Examples

Basic ARP Cache Display

show ip arp
Protocol  Address          Age (min)  Hardware Addr      Type   Interface
Internet  192.168.1.1              -   0001.967c.1301     ARPA   GigabitEthernet0/0
Internet  192.168.1.10           120   0050.7966.6800     ARPA   GigabitEthernet0/0
Internet  10.0.0.1                 -   0001.967c.1302     ARPA   GigabitEthernet0/1
Internet  10.0.0.5                45   0011.2233.4455     ARPA   GigabitEthernet0/1

Protocol: Always 'Internet' for IPv4. Address: IP address. Age (min): Minutes since entry learned; '-' means static. Hardware Addr: MAC address. Type: Encapsulation type (ARPA for Ethernet). Interface: Interface where entry learned.

Filtered ARP Entry for a Specific IP

show ip arp 192.168.1.10
Protocol  Address          Age (min)  Hardware Addr      Type   Interface
Internet  192.168.1.10           120   0050.7966.6800     ARPA   GigabitEthernet0/0

Filters output to show only the entry for 192.168.1.10. Useful for quickly checking a single host's MAC mapping.

Understanding the Output

The 'show ip arp' command displays the ARP cache, which maps IP addresses to MAC addresses. The 'Protocol' field indicates the network layer protocol (always 'Internet' for IPv4). 'Address' is the IP address. 'Age (min)' shows how many minutes ago the entry was learned; a hyphen '-' means the entry is static (manually configured). 'Hardware Addr' is the MAC address. 'Type' is the encapsulation type, typically 'ARPA' for Ethernet. 'Interface' is the interface through which the device is reachable. A missing or 'Incomplete' entry (not shown here) indicates that ARP resolution failed, often due to a misconfigured IP or a down device. Static entries do not age out, while dynamic entries are removed after the ARP timeout (default 4 hours). In a healthy network, you should see complete entries for all active IPs. Watch for entries with very high age values that may indicate stale mappings after network changes.

CCNA Exam Tips

1.

CCNA exam tip: Remember that 'show ip arp' shows only IPv4 ARP; for IPv6, use 'show ipv6 neighbors'.

2.

CCNA exam tip: A hyphen in the Age column means the entry is static; static ARP entries survive router reloads.

3.

CCNA exam tip: If you see 'Incomplete' in the Hardware Addr column, ARP resolution failed — common exam scenario for troubleshooting.

4.

CCNA exam tip: The ARP cache is per interface; entries learned on one interface are not used on another.

Common Mistakes

Mistake 1: Confusing 'show ip arp' with 'show mac address-table' — ARP maps IP to MAC, MAC table maps MAC to port.

Mistake 2: Assuming ARP entries persist after interface shutdown — dynamic entries are cleared when the interface goes down.

Mistake 3: Forgetting that proxy ARP can cause unexpected entries — a router may answer ARP requests for other devices.

Related Commands

clear arp-cache

Clears the entire ARP cache on the device, forcing the router to dynamically re-learn all ARP entries, typically used to resolve connectivity issues caused by stale or incorrect ARP mappings.

show ip interface

Displays the status and configuration of all IP interfaces on a Cisco router, including IP address, protocol status, and interface statistics, used for verifying interface IP configuration and troubleshooting connectivity issues.

show mac address-table

Displays the MAC address table (also known as CAM table) on a switch, showing which MAC addresses are learned on which VLAN and port, used to verify Layer 2 forwarding and detect issues like MAC flooding or incorrect port assignments.

Practice for the CCNA 200-301

Test your knowledge with hundreds of CCNA practice questions covering all exam domains.

Practice CCNA Questions