info > ARPTABLES

man perldoc info pydoc3 ri search

Not found locally for ARPTABLES. Try Google search

📖 NAME

arptables - ARP table administration (nft-based)

🚀 Quick Reference

Use Case	Command	Description
List all rules	arptables -L	List all rules in all chains
Add a rule	arptables -A chain rule-spec	Append rule to end of chain
Delete rule by number	arptables -D chain rulenum	Delete rule at given position
Flush all rules	arptables -F	Remove all rules from all chains
Set chain policy	arptables -P chain target	Set default target (ACCEPT/DROP/RETURN)
Create new chain	arptables -N chain-name	Create user-defined chain
Rename chain	arptables -E old new	Rename existing chain
Insert rule at position	arptables -I chain rulenum rule-spec	Insert rule before given number
Replace rule	arptables -R chain rulenum rule-spec	Replace rule at given position
Zero counters	arptables -Z	Reset packet/byte counters

📋 SYNOPSIS

arptables [-t table] -[AD] chain rule-specification [options]
arptables [-t table] -[RI] chain rulenum rule-specification [options]
arptables [-t table] -D chain rulenum [options]
arptables [-t table] -[LFZ] [chain] [options]
arptables [-t table] -[NX] chain
arptables [-t table] -E old-chain-name new-chain-name
arptables [-t table] -P chain target [options]

📝 DESCRIPTION

arptables is a user space tool, it is used to set up and maintain the tables of ARP rules in the Linux kernel. These rules inspect the ARP frames which they see. arptables is analogous to the iptables user space tool, but arptables is less complicated.

🔗 CHAINS

The kernel table is used to divide functionality into different sets of rules. Each set of rules is called a chain. Each chain is an ordered list of rules that can match ARP frames. If a rule matches an ARP frame, then a processing specification tells what to do with that matching frame. The processing specification is called a 'target'. However, if the frame does not match the current rule in the chain, then the next rule in the chain is examined and so forth. The user can create new (user-defined) chains which can be used as the 'target' of a rule.

🎯 TARGETS

A firewall rule specifies criteria for an ARP frame and a frame processing specification called a target. When a frame matches a rule, then the next action performed by the kernel is specified by the target. The target can be one of these values: ACCEPT, DROP, CONTINUE, RETURN, an 'extension' (see below) or a user-defined chain.

• ACCEPT — let the frame through
• DROP — drop the frame
• CONTINUE — check the next rule (useful for counting or logging)
• RETURN — stop traversing this chain, resume in previous chain
• Extension targets — see TARGET EXTENSIONS section
• User-defined chain — jump to custom chain

🗂️ TABLES

There is only one ARP table in the Linux kernel. The table is filter. You can drop the -t filter argument to the arptables command. The -t argument must be the first argument on the arptables command line, if used.

• -t, --table — filter, the only table, contains two built-in chains: INPUT (for frames destined for the host) and OUTPUT (for locally-generated frames).

⚙️ ARPTABLES COMMAND LINE ARGUMENTS

After the initial arptables command line argument, the remaining arguments can be divided into several different groups. These groups are commands, miscellaneous commands, rule-specifications, match-extensions, and watcher-extensions.

📜 COMMANDS

The arptables command arguments specify the actions to perform on the table defined with the -t argument. If you do not use the -t argument to name a table, the commands apply to the default filter table. With the exception of the -Z command, only one command may be used on the command line at a time.

• -A, --append — Append a rule to the end of the selected chain.
• -D, --delete — Delete the specified rule from the selected chain. Two ways: specify an interval of rule numbers (syntax: start_nr[:end_nr], negative numbers allowed), or specify the complete rule.
• -I, --insert — Insert the specified rule into the selected chain at the specified rule number. Number can be between -N and N+1 (where N is current number of rules). Number 0 is equivalent to -A.
• -R, --replace — Replace the specified rule at the specified rule number (1 to N).
• -P, --policy — Set the policy for the chain to the given target (ACCEPT, DROP, RETURN).
• -F, --flush — Flush the selected chain (or all chains if none specified). Does not change the chain policy.
• -Z, --zero — Set the counters of the selected chain to zero. Can be used with -L to print counters before zeroing.
• -L, --list — List all rules in the selected chain (or all chains if none specified).
• -N, --new-chain — Create a new user-defined chain (max 31 characters, unlimited number).
• -X, --delete-chain — Delete the specified user-defined chain (must have no remaining references). If no chain specified, delete all unreferenced user-defined chains.
• -E, --rename-chain — Rename a chain. Can rename standard chains (e.g., PREROUTING to PREBRIDGING) but be careful: renaming standard chains has no effect on kernel structure/function.

🛠️ MISCELLANEOUS COMMANDS

• -V, --version — Show the version of the arptables userspace program.
• -h, --help — Give a brief description of the command syntax.
• -j, --jump target — The target of the rule: ACCEPT, DROP, CONTINUE, RETURN, a target extension, or a user-defined chain.
• -c, --set-counters PKTS BYTES — Initialize the packet and byte counters of a rule (during INSERT, APPEND, REPLACE).

📐 RULE SPECIFICATIONS

The following command line arguments make up a rule specification (as used in the add and delete commands). A ! option before the specification inverts the test for that specification.

• -s, --source-ip [!] address[/mask] — Source IP specification.
• -d, --destination-ip [!] address[/mask] — Destination IP specification.
• --source-mac [!] address[/mask] — Source MAC address (6 hex numbers separated by colons).
• --destination-mac [!] address[/mask] — Destination MAC address (6 hex numbers separated by colons).
• -i, --in-interface [!] name — Interface receiving frame (for INPUT chain). Alias: --in-if.
• -o, --out-interface [!] name — Interface sending frame (for OUTPUT chain). Alias: --out-if.
• -l, --h-length length[/mask] — Hardware length (number of bytes).
• --opcode code[/mask] — Operation code (2 bytes). Values: 1=Request, 2=Reply, 3=Request_Reverse, 4=Reply_Reverse, 5=DRARP_Request, 6=DRARP_Reply, 7=DRARP_Error, 8=InARP_Request, 9=ARP_NAK.
• --h-type type[/mask] — Hardware type (2 bytes, hex). Values: 1=Ethernet.
• --proto-type type[/mask] — Protocol type (2 bytes). Values: 0x800=IPv4.

🧩 TARGET EXTENSIONS

arptables extensions are precompiled into the userspace tool. No need to explicitly load them with -m like iptables. These extensions deal with functionality supported by supplemental kernel modules.

mangle 🧹

• --mangle-ip-s IP address — Mangles Source IP Address to given value.
• --mangle-ip-d IP address — Mangles Destination IP Address to given value.
• --mangle-mac-s MAC address — Mangles Source MAC Address to given value.
• --mangle-mac-d MAC address — Mangles Destination MAC Address to given value.
• --mangle-target target — Target of ARP mangle operation (DROP, CONTINUE or ACCEPT; default is ACCEPT).

CLASSIFY 🏷️

Allows setting the skb->priority value (classify packet into a specific CBQ class).

• --set-class major:minor — Set the major and minor class value. Values always interpreted as hexadecimal.

MARK 🏷️

Allows setting the skb->mark value (classify packet by the mark in u32).

• --set-mark mark — Set the mark value. Values always interpreted as hexadecimal.
• --and-mark mark — Binary AND the mark with bits.
• --or-mark mark — Binary OR the mark with bits.

📌 NOTES

In this nft-based version of arptables, support for FORWARD chain has not been implemented. Since ARP packets are "forwarded" only by Linux bridges, the same may be achieved using FORWARD chain in ebtables.

📧 MAILINGLISTS

See http://netfilter.org/mailinglists.html

🔗 SEE ALSO

xtables-nft(8), iptables(8), ebtables(8), ip(8)

See https://wiki.nftables.org

📖 NAME 🚀 Quick Reference 📋 SYNOPSIS 📝 DESCRIPTION ⚙️ ARPTABLES COMMAND LINE ARGUMENTS 📌 NOTES 📧 MAILINGLISTS 🔗 SEE ALSO