arp​_cache

The Address Resolution Protocol (ARP) cache maps IP addresses to MAC addresses in the network stack on Linux, macOS & Windows.

Example

Basic query:

SELECT address, interface, mac FROM arp_cache;

Compare gateway IP addresses (which are typically routers) to a list of known MAC addresses:

SELECT * FROM arp_cache WHERE address IN (INSERT_GATEWAY_IPS) AND mac NOT IN (INSERT_EXPECTED_MAC_ADDRESSES);

Notes

The first six digits of a MAC address are the known as the Organizationally Unique Identifier

Manufacturer and model information can be looked up by MAC address using Wireshark OUI Lookup

OUI is used to populate manufacturer information in applications like Wi-Fi Explorer

Monitoring the ARP Cache is useful for maintaining network integrity & security. Querying data from this table can help to:

• Find network anomalies
• Troubleshoot network connectivity
• Uncover ARP Spoofing