info > ARPD

man perldoc info pydoc3 ri search

📛 NAME

arpd - userspace arp daemon.

🚀 Quick Reference

Use Case	Command	Description
📤 Dump database	arpd -l -b /var/tmp/arpd.db	Print database to stdout and exit
📥 Load from file	arpd -f file -b /var/tmp/arpd.db	Read ARP database from text file
👂 Passive collection	arpd -b /var/tmp/arpd.db	Only listen, no kernel interference
🔧 Kernel helper	arpd -b /var/tmp/arpd.db -a 1 eth0	Enable own queries, kernel leads
🔇 Replace kernel	arpd -b /var/tmp/arpd.db -a 3 -k eth0 eth1	Suppress kernel broadcasts, arpd controls
🛑 Graceful stop	killall arpd	Syncs DB and restores sysctl

📋 SYNOPSIS

Usage: arpd [ -lkh? ] [ -a N ] [ -b dbase ] [ -B number ] [ -f file ] [-p interval ] [ -n time ] [ -R rate ] [ <INTERFACES> ]

📖 DESCRIPTION

The arpd daemon collects gratuitous ARP information, saving it on local disk and feeding it to the kernel on demand to avoid redundant broadcasting due to limited size of the kernel ARP cache.

⚙️ OPTIONS

• -h, -? 📚 Print help
• -l 📤 Dump the arpd database to stdout and exit. Output: interface index, IP address, MAC address. Dead hosts show FAILED : time.
• -f <FILE> 📥 Read an arpd database from FILE (text format as dumped by -l). Exit after load, optionally list result with -l. Use - for stdin.
• -b <DATABASE> 📁 Location of the database file. Default: /var/lib/arpd/arpd.db.
• -a <NUMBER> 🔢 Number of broadcast queries to send before a host is considered dead. When arpd acts as kernel helper without this and insufficient data, 1‑second gaps may appear. Not fatal, but noticeable.
• -k 🔇 Suppress kernel broadcast queries. Only useful with -a.
• -n <TIME> ⏳ Timeout for negative cache (seconds). After a lookup fails, arpd waits this long before retrying. Use only with -k. Keep it close to a typical boot time without gratuitous ARP. Default: 60 seconds.
• -p <TIME> ⏰ Polling interval to the kernel ARP table (seconds, float allowed). Default: 30.
• -R <RATE> 🏎️ Max steady broadcast rate (packets per second). Default: 1.
• -B <NUMBER> 🔁 Number of broadcasts sent back‑to‑back. Default: 3. Together with -R, ensures no more than B + R * T queries over interval T.
• <INTERFACES> 🌐 List of network interfaces to watch (space separated). If omitted, monitors all interfaces, but assumes the user has already adjusted app_solicit in sysctl.

📡 SIGNALS

• 🛑 SIGINT, SIGTERM – graceful exit, syncing database and restoring sysctl parameters.
• 💾 SIGHUP – sync database to disk.
• 📊 SIGUSR1 – send statistics to syslog.
• ⚠️ All other signals – undefined effect; may corrupt the database and leave sysctl in an unpredictable state.

📝 NOTE

In order for arpd to serve as an ARP resolver, the kernel must be compiled with CONFIG_ARPD. If no interface list is given on the command line, app_solicit of the relevant interfaces must be enabled in /proc/sys/net/ipv4/neigh/*. Without this, arpd still collects gratuitous ARP information into its database.

💡 EXAMPLES

arpd -b /var/tmp/arpd.db

Start arpd to collect gratuitous ARP, without touching kernel functionality.

killall arpd ; arpd -l -b /var/tmp/arpd.db

Dump the database after some collection time.

arpd -b /var/tmp/arpd.db -a 1 eth0 eth1

Enable kernel helper, leaving the leading role to the kernel.

arpd -b /var/tmp/arpd.db -a 3 -k eth0 eth1

Completely replace kernel resolution on interfaces eth0 and eth1. The kernel still does unicast probing, but all broadcast activity is suppressed and controlled by arpd. This is the intended operational mode, but it is not the default to avoid accidental overly aggressive behaviour.

28 June, 2007 ARPD(8)

📛 NAME 🚀 Quick Reference 📋 SYNOPSIS 📖 DESCRIPTION ⚙️ OPTIONS 📡 SIGNALS 📝 NOTE 💡 EXAMPLES