Managing Network Devices with 'ip neighbour' (with examples)

The ip neighbour command is a powerful tool in Linux that allows for the management of ARP (Address Resolution Protocol) and neighbor tables. These tables are crucial for network communication as they map IP addresses to MAC addresses, enabling devices on the same network to communicate effectively. By using the ip neighbour command, network administrators can display, modify, and manage these mappings, facilitating efficient network operations.

Display the Neighbour/ARP Table Entries

Code:

ip neighbour

Motivation:

Understanding and auditing the current state of your ARP/neighbour table is essential for network diagnostics and troubleshooting. By displaying the entries, you can identify mappings between IP addresses and their associated MAC addresses, verify connectivity, and ensure there are no unauthorized devices on the network.

Explanation:

• ip: This is the root command used to manage and evaluate IP address-related tasks in Linux.
• neighbour: This subcommand focuses on ARP/neighbour table management.

Example Output:

192.168.1.5 dev eth0 lladdr 00:11:22:33:44:55 STALE
192.168.1.10 dev wlan0 lladdr 66:77:88:99:aa:bb REACHABLE

This output shows two entries. For example, the IP address 192.168.1.5 is associated with the MAC address 00:11:22:33:44:55 on the eth0 device, and the state of the connection is STALE.

Remove Entries in the Neighbour Table on Device eth0

Code:

sudo ip neighbour flush dev eth0

Motivation:

Removing entries in the neighbour table is often necessary to clear outdated mappings, especially if the network configuration changes frequently or if there are connectivity issues. Flushing the table can resolve conflicts or errors caused by expired or incorrect entries and help restore proper network communication.

Explanation:

• sudo: Elevated permissions are required to modify network settings.
• ip: The command suite for managing IP addresses and routes.
• neighbour: Deals with neighbour table operations.
• flush: Removes specified entries from the table.
• dev eth0: Specifies the network device eth0 from which entries should be removed.

Example Output:

Neighbour table flushed successfully.

This output indicates that all entries related to eth0 have been successfully removed, resetting the state and allowing for fresh entries to be populated when new network interactions occur.

Perform a Neighbour Lookup and Return a Neighbour Entry

Code:

ip neighbour get 192.168.1.5 dev eth0

Motivation:

Performing a specific lookup is helpful for validating whether a particular device is reachable and correctly mapped in the neighbour table. This can assist in debugging connectivity issues or confirming the presence of a specific network device.

Explanation:

• ip: Initiates the command suite.
• neighbour: Operates on the ARP/ neighbour table.
• get 192.168.1.5: Executes a query for the specified lookup_ip.
• dev eth0: Targets the query to a specific network interface device, eth0.

Example Output:

192.168.1.5 dev eth0 lladdr 00:11:22:33:44:55 REACHABLE

In this example, the lookup confirms that the device with IP 192.168.1.5 is present and reachable on the eth0 interface, with the associated MAC address specified.

Add or Delete an ARP Entry for the Neighbour IP Address to eth0

Code:

sudo ip neighbour add 192.168.1.5 lladdr 00:11:22:33:44:55 dev eth0 nud reachable

Motivation:

Explicitly adding or deleting an ARP entry can be integral to network administration when configuring static routes, managing network security, or orchestrating device-specific traffic routing. This control helps ensure precision in network operations, particularly in complex or secure environments where automatic ARP responses are insufficient.

Explanation:

• sudo: Allows execution of the command with administrative privileges.
• ip: This introduces the command line power to manipulate network configurations.
• neighbour: Aims the operation at the ARP/neighbour table.
• add 192.168.1.5: Directs the command to add an entry for the IP.
• lladdr 00:11:22:33:44:55: Specifies the MAC address for the entry.
• dev eth0: Targets the action to device eth0.
• nud reachable: Sets the state of the neighbour entry as reachable.

Example Output:

Entry added successfully.

This output reflects the successful addition of the ARP entry, ensuring network devices within this scope recognize the specified IP-MAC pairing.

Change or Replace an ARP Entry for the Neighbour IP Address to eth0

Code:

sudo ip neighbour change 192.168.1.5 lladdr aa:bb:cc:dd:ee:ff dev eth0

Motivation:

Changing or replacing ARP entries is useful when devices upgrade their network cards or MAC addresses. This operation ensures network consistency without waiting for older entries to timeout, avoiding communication disruption and maintaining network accuracy with updated device identities.

Explanation:

• sudo: Execute the command with necessary permissions.
• ip: Calls the command line interface for managing network entities.
• neighbour: Focuses the operation on the ARP/neighbour table.
• change 192.168.1.5: Modifies an existing entry for the specified IP.
• lladdr aa:bb:cc:dd:ee:ff: Updates to a new MAC address.
• dev eth0: Specifies the network interface device to apply the change.

Example Output:

Entry modified successfully.

This confirms that the ARP entry was updated successfully, replacing the old MAC address with the new one for the given IP.

Conclusion:

The ip neighbour command is essential for managing and manipulating ARP and neighbour tables in a Linux environment. These operations, from displaying entries and removing them to adding and modifying entries, are pivotal for maintaining an efficient and secure network infrastructure. By mastering this command, network administrators can ensure smooth and reliable communication between devices on the network.