show ip arp
Map IP addresses to MAC addresses for troubleshooting connectivity, identifying hosts, and detecting ARP spoofing.
Definition: show ip arp is a Cisco IOS privileged exec command. Displays the ARP cache mapping IP addresses to MAC addresses, the age of each entry, and the interface through which the host is reachable.
Overview
The `show ip arp` command is a fundamental troubleshooting and verification tool in Cisco IOS that displays the Address Resolution Protocol (ARP) cache. ARP is a Layer 2 protocol used to map IP addresses (Layer 3) to MAC addresses (Layer 2) on a local network segment. When a device needs to send an IP packet to another device on the same Ethernet network, it must first resolve the destination IP address to a MAC address.
The ARP cache stores these mappings for a period of time (the ARP timeout, typically 4 hours for dynamic entries) to avoid repeated ARP broadcasts. This command is essential for verifying connectivity, diagnosing Layer 2 issues, and understanding the neighbor relationships on a broadcast domain. You would reach for `show ip arp` when you suspect a Layer 2 problem, such as a device not responding to pings despite being reachable at Layer 3, or when you need to confirm the MAC address associated with a particular IP address.
It is often used in conjunction with `ping`, `traceroute`, and `show mac address-table` to isolate issues. For example, if a ping fails but the ARP entry exists, the problem may be at Layer 2 or above; if the ARP entry is missing, the issue is likely ARP resolution. The command does not affect the running configuration and is available in privileged EXEC mode (enable mode).
Output can be buffered if the terminal length is set, but typically it fits on one screen. There is no impact on the router or switch performance beyond the normal CPU usage for reading the ARP table. Understanding ARP is critical for CCNA and CCNP candidates because it underpins all Ethernet-based IP communication and is a common source of troubleshooting scenarios in exams and real-world networks.
show ip arp [ip-address | hostname | mac-address | interface interface-id | vlan vlan-id]When to Use This Command
- Find the MAC address of a host from its IP address for switch port identification
- Verify ARP resolution is working when a host cannot reach its default gateway
- Detect duplicate IP addresses — two MAC addresses for one IP indicates a conflict
- Identify ARP spoofing — unexpected MAC address for a known IP
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| ip-address | A.B.C.D | Displays the ARP entry for a specific IP address. If omitted, all ARP entries are shown. Common mistake: using a hostname instead of an IP address; the command does not resolve hostnames. |
| hostname | WORD | Displays ARP entries for a specific hostname (if the hostname is known via DNS or host table). Rarely used; most engineers use the IP address parameter instead. |
| vlan | <1-4094> | On switches, displays ARP entries for a specific VLAN. Useful in multi-VLAN environments to isolate ARP activity to a particular broadcast domain. Common mistake: forgetting that VLANs must exist and have an SVI for ARP to be learned. |
| interface | interface-type interface-number | Displays ARP entries learned on a specific interface (e.g., GigabitEthernet0/1). Helps in troubleshooting interface-specific issues. Common mistake: using the wrong interface name or number, leading to no output. |
Command Examples
ARP cache on a router
Router# show ip arp Protocol Address Age (min) Hardware Addr Type Interface Internet 192.168.1.1 - c8b3.73a2.1234 ARPA GigabitEthernet0/0 Internet 192.168.1.10 12 000c.29ab.5678 ARPA GigabitEthernet0/0 Internet 192.168.1.20 5 000c.29cd.9012 ARPA GigabitEthernet0/0
Understanding the Output
Age of - means the interface's own IP (no expiry). Positive age = minutes since last ARP reply. ARPA = Ethernet ARP type.
Entries expire after 4 hours by default (configurable with arp timeout). Incomplete entries (no MAC shown) indicate ARP requests sent but no reply received.
Configuration Scenarios
Verify ARP resolution between two directly connected routers
Two routers, R1 and R2, are connected via a point-to-point Ethernet link. You need to confirm that R1 has resolved R2's IP address to its MAC address before routing traffic.
Topology
R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2Steps
- 1.Step 1: On R1, enter privileged EXEC mode: R1> enable
- 2.Step 2: Display the ARP cache: R1# show ip arp
- 3.Step 3: Look for an entry with IP address 10.0.12.2 and note the MAC address and interface (GigabitEthernet0/0).
- 4.Step 4: Optionally, ping R2 to trigger ARP if the entry is missing: R1# ping 10.0.12.2
- 5.Step 5: Verify the ARP entry again after ping.
! No configuration is needed for ARP; it is enabled by default. ! However, ensure interfaces are up and IP addresses are configured: interface GigabitEthernet0/0 ip address 10.0.12.1 255.255.255.252 no shutdown
Verify: R1# show ip arp Protocol Address Age (min) Hardware Addr Type Interface Internet 10.0.12.1 - aabb.cc00.0100 ARPA GigabitEthernet0/0 Internet 10.0.12.2 0 aabb.cc00.0200 ARPA GigabitEthernet0/0 The entry for 10.0.12.2 shows age 0 (just learned) and the correct MAC address.
Watch out: If the ARP entry shows 'Incomplete', it means the ARP request was sent but no reply was received. This often indicates a Layer 1 or Layer 2 issue, such as a bad cable, wrong VLAN, or the remote device is down.
Troubleshoot missing ARP entry for a host on a switch
A host (192.168.1.100) connected to a switch (SW1) is not reachable from the default gateway (router). You suspect the switch does not have an ARP entry for the host.
Topology
Host(192.168.1.100/24)---(Gi0/1)SW1(Gi0/2)---(Gi0/0)R1(192.168.1.1/24)Steps
- 1.Step 1: On SW1, enter privileged EXEC mode: SW1> enable
- 2.Step 2: Check the ARP cache for the host: SW1# show ip arp 192.168.1.100
- 3.Step 3: If no entry, check the MAC address table to see if the host's MAC is learned: SW1# show mac address-table address <host-MAC>
- 4.Step 4: If the MAC is not in the table, check the interface status: SW1# show interfaces GigabitEthernet0/1
- 5.Step 5: If the interface is up/up, clear the ARP cache on the router and ping the host from the router to trigger ARP: R1# clear arp; R1# ping 192.168.1.100
! On the switch, ensure the host's VLAN exists and the interface is in the correct VLAN: interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 spanning-tree portfast ! On the router, ensure the SVI for VLAN 10 is configured: interface Vlan10 ip address 192.168.1.1 255.255.255.0 no shutdown
Verify: After ping, on SW1: show ip arp 192.168.1.100 Protocol Address Age (min) Hardware Addr Type Interface Internet 192.168.1.100 0 aabb.cc00.1000 ARPA Vlan10 The entry should appear with age 0 and the correct MAC.
Watch out: On a switch, ARP entries are learned on the SVI (VLAN interface), not on physical ports. If the SVI is down (e.g., VLAN not created or no active ports in VLAN), ARP will not work. Also, ensure the host has the correct default gateway configured.
Troubleshooting with This Command
When troubleshooting network connectivity issues, `show ip arp` is often the first command to run after verifying basic Layer 1 and Layer 2 status. A healthy ARP cache shows entries with an 'Age' in minutes (for dynamic entries) and a valid MAC address. The 'Type' field typically shows 'ARPA' for Ethernet.
Problem indicators include: 'Incomplete' entries (ARP request sent but no reply), missing entries for known IP addresses, or stale entries (age close to the timeout). Focus on the 'Age' field: if an entry is very old (e.g., > 4 hours), it may be stale and should be cleared. Common symptoms: a host is pingable from some devices but not others—check if the ARP entry exists on the source device.
If a ping fails, check the ARP entry for the destination; if missing, the issue is ARP resolution. Step-by-step diagnostic flow: 1) Ping the destination IP; if successful, ARP is working. 2) If ping fails, run `show ip arp` on the source device. 3) If the destination IP is not in the ARP table, check connectivity to the local network (e.g., interface status, VLAN). 4) If the entry is 'Incomplete', verify that the destination device is powered on, connected, and not blocking ARP (e.g., firewall). 5) If the entry exists but ping fails, check for Layer 3 issues like routing or ACLs. Correlate with `show mac address-table` to confirm the MAC address is learned on the correct interface.
Use `debug arp` (with caution in production) to see ARP requests and replies in real time. On routers, also check `show ip interface` to ensure proxy ARP is enabled if needed. Remember that ARP is local to a broadcast domain; for remote destinations, ARP resolves the next-hop router's MAC, not the final destination.
In summary, `show ip arp` is a quick and powerful tool to isolate Layer 2 problems before moving up the OSI model.
CCNA Exam Tips
CCNA exam: know that ARP maps Layer 3 (IP) to Layer 2 (MAC)
A router only has ARP entries for hosts in directly connected subnets
If a host cannot communicate, check show ip arp for its gateway — an Incomplete entry means the gateway cannot reach the host at Layer 2
Common Mistakes
Expecting a router to have ARP entries for remote hosts — routers only ARP for directly connected next-hops
Confusing show ip arp (IP-to-MAC) with show mac address-table (MAC-to-port)
Forgetting that ARP entries age out (default 4 hours on IOS)
show ip arp vs show interfaces
The 'show ip arp' and 'show interfaces' commands are both layer 2/3 diagnostics frequently used in troubleshooting connectivity, but they serve distinct purposes: ARP focuses on IP-to-MAC resolution, while interfaces display physical and data-link statistics. They are often confused because both involve MAC addresses and interfaces, yet one is for the ARP cache and the other for interface metrics.
| Aspect | show ip arp | show interfaces |
|---|---|---|
| OSI Layer Focus | Layer 3 (IP) and Layer 2 (ARP resolution) | Layer 1 (physical) and Layer 2 (data-link) |
| Primary Data Displayed | IP address, MAC address, encapsulation type, age, interface | Interface status, line protocol, MAC address, MTU, speed, duplex, errors, packet counts |
| Scope | Global ARP cache (all interfaces) or specific IP | All interfaces or a specific interface |
| Typical Troubleshooting Use | Identifying IP-to-MAC mapping issues, duplicate IPs, or missing ARP entries | Checking link state, speed/duplex mismatches, input/output errors, or throughput issues |
| Output Variability | Output changes as ARP entries age out or are refreshed | Real-time counters reset on interface flap or clear counters command |
Use 'show ip arp' when you need to verify the IP-to-MAC resolution of a specific host or troubleshoot Layer 3 connectivity failures due to missing or incorrect ARP entries.
Use 'show interfaces' when you suspect physical layer problems, need to check interface utilization, or want to view error counters for performance monitoring.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the `show ip arp` command syntax and output are largely identical to classic IOS. However, on some IOS-XE platforms, the output may include additional fields like 'Flags' or 'VLAN' even without the vlan parameter. The NX-OS equivalent is `show ip arp` as well, but the output format differs slightly: it includes a 'Age' column in seconds (not minutes) and a 'Flags' column.
On NX-OS, you can also use `show ip arp detail` for more information. The ASA firewall uses `show arp` (without 'ip') and the output includes the interface, IP address, MAC address, and type (static/dynamic). In IOS-XR, the command is `show arp` and the output is similar but with different column headers (e.g., 'Address' instead of 'IP Address').
Between IOS versions, the basic behavior remains consistent, but in 15.x and later, there is support for VRF-aware ARP: you can use `show ip arp vrf <vrf-name>` to view ARP entries for a specific VRF. In 12.x, VRF support was limited. Also, in newer IOS versions, the default ARP timeout may be configurable per interface.
On switches running IOS, the command also shows ARP entries for SVIs; on routers, it shows entries for all IP-enabled interfaces. Always check the specific platform documentation for any nuances.
Related Commands
show cdp neighbors
Displays information about directly connected Cisco devices discovered via CDP (Cisco Discovery Protocol) including device IDs, local and remote interfaces, holdtime, device capabilities, and platform model.
show interfaces
Displays detailed Layer 1 and Layer 2 statistics for all interfaces or a specific interface: line protocol state, hardware type, MAC address, MTU, bandwidth, duplex, speed, input/output rates, error counters, and queue statistics.
show ip interface brief
Displays a one-line summary of all interfaces showing the IP address assigned, operational status (up/down), and line protocol status. The fastest way to get a device health overview.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions