Linux · routing & neighbours

ip neigh

whose MAC is that

ip neigh lists what the host has learned about the machines on its own segment: which MAC answers for which IP address, and how fresh that answer is. It is the ARP cache and its IPv6 equivalent in one table, and it is where on-link delivery succeeds or fails.

Routing picks the next hop by IP — but the frame is addressed to a MAC from this table.

Reads

Neighbour table

the ARP and NDP cache

Short form

ip n

replaces arp -n

Scope

One segment

never crosses a router

Entries expire

In seconds

then are re-verified

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashiproute2

$ ip neigh

1192.168.1.1 dev eth0 lladdr 3c:84:6a:12:f0:01 REACHABLE

2192.168.1.57 dev eth0 lladdr b8:27:eb:44:0d:9a STALE

3192.168.1.90 dev eth0 FAILED

4fe80::3e84:6aff:fe12:f001 dev eth0 lladdr 3c:84:6a:12:f0:01 router REACHABLE

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

REACHABLE is a mapping confirmed recently

The gateway at 192.168.1.1 answered within the last few tens of seconds. lladdr is the link-layer address frames for it are sent to.

STALE is not a fault

The entry has not been confirmed lately. The kernel will still use it and quietly re-check it the next time a packet goes that way.

FAILED means nobody answered the ARP request

There is no lladdr because no host claimed 192.168.1.90. The machine is off, on another VLAN, or the address is simply unused.

The IPv6 entry is the same router

The MAC matches the first line: this is the gateway seen through neighbour discovery. "router" records that it sent router advertisements.

Switches

A switch changes how the command behaves. These are the ones used day to day; man ip lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-4: Show only IPv4 neighbours — the ARP table.
-6: Show only IPv6 neighbours — the NDP table.
-s: Add statistics: how long ago each entry was used and confirmed.
-c: Colour the output.
-j: Print JSON, for scripts.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

ip neigh show dev eth0

Only the neighbours learned on one interface.

ip neigh flush dev eth0

Empties the cache for that interface, forcing every mapping to be re-learned. The first thing to try after a device was swapped.

ip neigh replace 192.168.1.1 lladdr 3c:84:6a:12:f0:01 dev eth0 nud permanent

Pins the gateway's MAC so no ARP reply can change it.

ip -s neigh

Adds how long ago each entry was used, confirmed and updated.

In cybersecurity

ARP has no authentication: a host believes whichever reply arrived last. This table is where that trust is recorded, and where its abuse shows up.

ARP spoofing

A neighbour that answers for the gateway's IP inserts itself into every conversation leaving the segment.

One MAC, two IPs

The same lladdr against the gateway and against another host is the classic signature of a poisoned cache.

A gateway MAC that changes

Note the legitimate value once. A different one tomorrow is either new hardware or an interception.

Static entries

A permanent entry for the gateway cannot be overwritten by a forged reply — practical on servers, tedious on laptops.

Switch-side defence

Dynamic ARP inspection and DHCP snooping drop forged replies before any host sees them. The real fix is in the switch.

IPv6 has the same hole

Neighbour discovery can be spoofed just as ARP can. RA guard and ND inspection are the equivalents.

Protocols it shows

ARP Ethernet ICMPv6 IPv4

Read alongside

ip routePrints the kernel routing table and answers which interface and next hop a given destination will use.tcpdumpCaptures packets from an interface and prints one line per packet, filtered by an expression you supply.