In this lesson, you will learn how to troubleshoot Layer-2 connectivity issues by directly inspecting and manipulating the Linux Address Resolution Protocol (ARP) table.
The ARP Table: Bridging IP to MAC
When your kernel sends an IP packet, it must eventually deliver that data to a physical hardware address (MAC address) on the local segment. The ARP table acts as the system’s "phonebook," mapping known IP addresses to their corresponding MAC addresses on the local network.
If a system cannot resolve an IP to a MAC address, the packets cannot leave the machine, leading to "Destination Host Unreachable" errors. To view your current table, use the ip neighbor command:
# View the ARP/neighbor table
ip neighbor show
Debugging Connectivity
When you suspect a connectivity issue, look for the state of the entry. You might see REACHABLE, STALE, or FAILED. A FAILED state indicates that your kernel tried to send an ARP request (via a broadcast) but received no reply, suggesting the remote host is down, the cable is unplugged, or a firewall is blocking the traffic.
If you encounter a "stale" or incorrect entry, you can manually force the kernel to clear it, forcing a fresh discovery the next time the system attempts to communicate:
# Delete a specific entry to force a refresh
sudo ip neighbor del 192.168.1.50 dev eth0
# Manually add an entry (useful for static networking environments)
sudo ip neighbor add 192.168.1.50 lladdr aa:bb:cc:dd:ee:ff dev eth0 nud permanent
Why Manual Manipulation Matters
While the kernel automatically manages these entries, manual manipulation is vital for debugging "ARP spoofing" or testing hardware connectivity in isolated environments. By observing the nud (Neighbor Unreachability Detection) states, you can pinpoint whether the issue lies in the physical link layer or the local network configuration.
Key Takeaway: The ARP table is your primary diagnostic tool for Layer-2 visibility; if the kernel cannot resolve a MAC address, your network traffic will fail to leave the local interface.