show arp

IP-to-MAC bindings the device has resolved.

troubleshooting

What it does

Bridges layer 3 to layer 2. An incomplete entry means the ARP request went unanswered — the target is off, firewalled, or not on that segment at all.

Per vendor

PlatformCommand
Cisco IOSshow arp
Cisco NX-OSshow ip arp
Juniper JunOSshow arp
MikroTik RouterOS/ip arp print
FortiOSget system arp

Useful variations

  • One addressshow arp | include 10.20.0.55
  • Clear a stale entryclear arp-cache

Pitfalls

The misreadings that actually cost people time.

  • Incomplete entries are normal for addresses that do not exist; a burst of them suggests a scan or a wrong subnet mask somewhere.
  • Two IPs sharing one MAC is normal for a router doing proxy ARP — or a sign of ARP spoofing.
  • Clearing the whole cache on a busy router causes a brief traffic storm as it re-resolves.

Related

show mac address-tableshow ip interface brief