{
    "mode": "man",
    "parameter": "arpd",
    "section": "8",
    "url": "https://www.chedong.com/phpMan.php/man/arpd/8/json",
    "generated": "2026-06-15T21:13:03Z",
    "synopsis": "Usage:  arpd  [  -lkh?  ] [ -a N ] [ -b dbase ] [ -B number ] [ -f file ] [-p interval ] [ -n\ntime ] [ -R rate ] [ <INTERFACES> ]",
    "sections": {
        "NAME": {
            "content": "arpd - userspace arp daemon.\n\n",
            "subsections": []
        },
        "SYNOPSIS": {
            "content": "Usage:  arpd  [  -lkh?  ] [ -a N ] [ -b dbase ] [ -B number ] [ -f file ] [-p interval ] [ -n\ntime ] [ -R rate ] [ <INTERFACES> ]\n\n",
            "subsections": []
        },
        "DESCRIPTION": {
            "content": "The arpd daemon collects gratuitous ARP information, saving it on local disk and  feeding  it\nto the kernel on demand to avoid redundant broadcasting due to limited size of the kernel ARP\ncache.\n\n",
            "subsections": []
        },
        "OPTIONS": {
            "content": "-h -?  Print help\n\n-l     Dump the arpd database to stdout and exit. The output consists of three  columns:  the\ninterface  index,  the  IP address of the interface, and the MAC address of the inter‐\nface. Negative entries for dead hosts are also shown, in this case the MAC address  is\nreplaced by the word FAILED followed by a colon and the most recent time when the fact\nthat the host is dead was proven.\n",
            "subsections": [
                {
                    "name": "-f <FILE>",
                    "content": "Read and load an arpd database from FILE in a text format similar to  that  dumped  by\noption  -l. Exit after load, possibly listing resulting database, if option -l is also\ngiven. If FILE is -, stdin is read to get the ARP table.\n",
                    "flag": "-f",
                    "arg": "<FILE>"
                },
                {
                    "name": "-b <DATABASE>",
                    "content": "the location of the database file. The default location is /var/lib/arpd/arpd.db\n",
                    "flag": "-b",
                    "arg": "<DATABASE>"
                },
                {
                    "name": "-a <NUMBER>",
                    "content": "With this option, arpd not only passively listens for ARP packets  on  the  interface,\nbut  also sends broadcast queries itself. NUMBER is the number of such queries to make\nbefore a destination is considered dead. When arpd is started as kernel  helper  (i.e.\nwith  appsolicit  enabled  in  sysctl or even with option -k) without this option and\nstill did not learn enough information, you can observe 1 second gaps in service.  Not\nfatal, but not good.\n\n-k     Suppress  sending  broadcast  queries  by the kernel. This option only makes sense to‐\ngether with option -a.\n",
                    "flag": "-a",
                    "arg": "<NUMBER>"
                },
                {
                    "name": "-n <TIME>",
                    "content": "Specifies the timeout of the negative cache. When resolution  fails,  arpd  suppresses\nfurther  attempts  to  resolve  for this period. This option only makes sense together\nwith option '-k'. This timeout should not be too much longer than the boot time  of  a\ntypical host not supporting gratuitous ARP. Default value is 60 seconds.\n",
                    "flag": "-n",
                    "arg": "<TIME>"
                },
                {
                    "name": "-p <TIME>",
                    "content": "The time to wait in seconds between polling attempts to the kernel ARP table. TIME may\nbe a floating point number. The default value is 30.\n",
                    "flag": "-p",
                    "arg": "<TIME>"
                },
                {
                    "name": "-R <RATE>",
                    "content": "Maximal steady rate of broadcasts sent by arpd in packets per second. Default value is\n1.\n",
                    "flag": "-R",
                    "arg": "<RATE>"
                },
                {
                    "name": "-B <NUMBER>",
                    "content": "The  number of broadcasts sent by arpd back to back. Default value is 3. Together with\nthe -R option, this option ensures that the number of ARP queries that  are  broadcast\ndoes not exceed B+R*T over any interval of time T.\n\n<INTERFACES>  is  a  list  of  names  of networking interfaces to watch. If no interfaces are\ngiven, arpd monitors all the interfaces. In this case arpd does not adjust sysctl parameters,\nit is assumed that the user does this himself after arpd is started.\n",
                    "flag": "-B",
                    "arg": "<NUMBER>"
                }
            ]
        },
        "SIGNALS": {
            "content": "When  arpd receives a SIGINT or SIGTERM signal, it exits gracefully, syncing the database and\nrestoring adjusted sysctl parameters. On a SIGHUP it syncs the database to disk. With SIGUSR1\nit sends some statistics to syslog. The effect of any other signals is undefined. In particu‐\nlar, they may corrupt the database and leave the sysctl parameters in an unpredictable state.\n",
            "subsections": []
        },
        "NOTE": {
            "content": "In order for arpd to be able to serve as ARP resolver, the kernel must be compiled  with  the\noption  CONFIGARPD  and, in the case when interface list in not given on command line, vari‐\nable appsolicit on interfaces of interest should be in /proc/sys/net/ipv4/neigh/*.  If  this\nis not made arpd still collects gratuitous ARP information in its database.\n",
            "subsections": []
        },
        "EXAMPLES": {
            "content": "arpd -b /var/tmp/arpd.db\nStart arpd to collect gratuitous ARP, but not messing with kernel functionality.\n\nkillall arpd ; arpd -l -b /var/tmp/arpd.db\nLook at result after some time.\n\narpd -b /var/tmp/arpd.db -a 1 eth0 eth1\nEnable kernel helper, leaving leading role to kernel.\n\narpd -b /var/tmp/arpd.db -a 3 -k eth0 eth1\nCompletely  replace  kernel  resolution  on interfaces eth0 and eth1. In this case the\nkernel still does unicast probing to validate entries, but all the broadcast  activity\nis suppressed and made under authority of arpd.\n\nThis is the mode in which arpd normally is supposed to work. It is not the default to prevent\noccasional enabling of too aggressive a mode.\n\n\n\n28 June, 2007                                    ARPD(8)",
            "subsections": []
        }
    },
    "summary": "arpd - userspace arp daemon.",
    "flags": [
        {
            "flag": "-f",
            "long": null,
            "arg": "<FILE>",
            "description": "Read and load an arpd database from FILE in a text format similar to that dumped by option -l. Exit after load, possibly listing resulting database, if option -l is also given. If FILE is -, stdin is read to get the ARP table."
        },
        {
            "flag": "-b",
            "long": null,
            "arg": "<DATABASE>",
            "description": "the location of the database file. The default location is /var/lib/arpd/arpd.db"
        },
        {
            "flag": "-a",
            "long": null,
            "arg": "<NUMBER>",
            "description": "With this option, arpd not only passively listens for ARP packets on the interface, but also sends broadcast queries itself. NUMBER is the number of such queries to make before a destination is considered dead. When arpd is started as kernel helper (i.e. with appsolicit enabled in sysctl or even with option -k) without this option and still did not learn enough information, you can observe 1 second gaps in service. Not fatal, but not good. -k Suppress sending broadcast queries by the kernel. This option only makes sense to‐ gether with option -a."
        },
        {
            "flag": "-n",
            "long": null,
            "arg": "<TIME>",
            "description": "Specifies the timeout of the negative cache. When resolution fails, arpd suppresses further attempts to resolve for this period. This option only makes sense together with option '-k'. This timeout should not be too much longer than the boot time of a typical host not supporting gratuitous ARP. Default value is 60 seconds."
        },
        {
            "flag": "-p",
            "long": null,
            "arg": "<TIME>",
            "description": "The time to wait in seconds between polling attempts to the kernel ARP table. TIME may be a floating point number. The default value is 30."
        },
        {
            "flag": "-R",
            "long": null,
            "arg": "<RATE>",
            "description": "Maximal steady rate of broadcasts sent by arpd in packets per second. Default value is 1."
        },
        {
            "flag": "-B",
            "long": null,
            "arg": "<NUMBER>",
            "description": "The number of broadcasts sent by arpd back to back. Default value is 3. Together with the -R option, this option ensures that the number of ARP queries that are broadcast does not exceed B+R*T over any interval of time T. <INTERFACES> is a list of names of networking interfaces to watch. If no interfaces are given, arpd monitors all the interfaces. In this case arpd does not adjust sysctl parameters, it is assumed that the user does this himself after arpd is started."
        }
    ],
    "examples": [
        "arpd -b /var/tmp/arpd.db",
        "Start arpd to collect gratuitous ARP, but not messing with kernel functionality.",
        "killall arpd ; arpd -l -b /var/tmp/arpd.db",
        "Look at result after some time.",
        "arpd -b /var/tmp/arpd.db -a 1 eth0 eth1",
        "Enable kernel helper, leaving leading role to kernel.",
        "arpd -b /var/tmp/arpd.db -a 3 -k eth0 eth1",
        "Completely  replace  kernel  resolution  on interfaces eth0 and eth1. In this case the",
        "kernel still does unicast probing to validate entries, but all the broadcast  activity",
        "is suppressed and made under authority of arpd.",
        "This is the mode in which arpd normally is supposed to work. It is not the default to prevent",
        "occasional enabling of too aggressive a mode.",
        "28 June, 2007                                    ARPD(8)"
    ],
    "see_also": []
}