Where Is the Arp Cache on Linux?

Where Is the Arp Cache on Linux?

Where, in memory, does the ARP cache exist? I tried searching it up online but didn't find anything.

1

1 Answer

GNU/Linux, unlike MacOSx, uses the /proc directory structure, a.k.a. procfs, to store system data. The arp cache is located at /proc/net/arp You print the data to stdout directly from that system file via:

cat /proc/net/arp

I realized that you may also want the memory address that the kernel uses to find the arp cache. The exact address may vary. However, you can find the memory address table for all arp memory addresses the kernel uses in /proc/kallsyms

cat /proc/kallsyms |grep arp_

May be helpful as well.

3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Marcus Vance
Author

Marcus Vance

Marcus Vance is a cybersecurity auditor and technology writer dedicated to educating the public about online safety, data privacy regulations, enterprise security, and emerging cyber threats.