Hack the Route Start free Open app Neighbours
ip neigh
Shows the neighbour table, the IP-to-MAC answers this device learned with ARP or neighbour discovery.
Before a device sends a packet on its own network it needs the neighbour's MAC address, and it keeps the
answers here. Each entry has a state: REACHABLE (recently confirmed), STALE (to recheck on next use),
FAILED or INCOMPLETE (nobody answered). For an address on another network you will find the gateway here,
never the far address. Two addresses with the same MAC is the fingerprint of ARP spoofing.
ip neigh command usage
ip [-6] neigh [show [ADDRESS] [dev CARD]] ip neigh flush all ip neigh add ADDRESS lladdr MAC dev CARD nud permanent
Options
-
-s - with times: seconds since each entry was used, confirmed and changed; with flush, how many went
-
flush all - forget every entry, so the next packet asks again
-
show 10.0.1.2 - only the entry for that address
-
del 10.0.1.2 - remove the entry for that address, pinned or not
-
dev eth0 - on that card
-
add 10.0.1.2 - a new entry for that address, refused if it has one
-
lladdr 02:00:0a:00:01:02 - the MAC address the entry gives
-
nud permanent - a fixed entry that ARP answers cannot change
-
-6 - the IPv6 table, filled by neighbour discovery
ip neigh examples
-
ip neigh - Lists every neighbour this device knows, with its MAC address and state.
-
ip neigh show 10.0.1.2 - Shows which MAC address this device uses for 10.0.1.2.
-
ip neigh flush all - Empties the neighbour table, so every address is asked for again.
-
ip neigh replace 10.0.1.2 lladdr 02:42:0a:00:01:02 dev eth0 nud permanent - Pins 10.0.1.2 to one MAC address, so forged ARP replies cannot move it.
-
ip -6 neigh - Lists IPv6 neighbours, learned with neighbour discovery instead of ARP.
Reading the output
$ ip neigh 10.0.1.2 dev eth0 lladdr 4e:d8:1b:80:a0:83 REACHABLE 10.0.1.30 dev eth0 FAILED
10.0.1.2 … lladdr 4e:d8:…: frames for 10.0.1.2 go to this MAC address.REACHABLE: confirmed in the last few seconds.STALEis normal too: it is rechecked when next used.FAILEDwith nolladdr: nobody answered the ARP request. The device is off, on another network, or the prefix is wrong.
Pitfalls
- Only neighbours this device has talked to are listed: ping first, then look.
flush allleavesPERMANENTentries in place: remove a pinned one withip neigh del ADDRESS dev CARD.- The same MAC address against two IP addresses, one of them your gateway, means someone answers for the gateway.