3

How to clear arp cache in linux by program, not by using arp command? Are there library functions avaliable to implement this?

=========================================================================== EDIT

In linux, I want to clear arp cache periodically and send ping packets to find hosts in LAN(by collecting arp response and ICMP reply). As some hosts don't reply ping, I try to receive arp response and ICMP reply in my program. But if arp cache has the IP information, it doesn't send arp request for that IP, and the topology may not be complete. So I want to clear arp cache periodically. How can I clear arp cache periodically in my program?Thanks for your time.

Improve this question
4
  • Which language are you programming in? For C, you could use the execv call. See this answer for a code example: stackoverflow.com/a/5460448/579698, For Java see stackoverflow.com/a/13991171/579698 Commented Mar 10, 2016 at 7:55
  • Thanks! Yes, for C. The program needs to clear arp cache periodically and do other things. I don't think execv can do this.If execute another file, how can I control the process to do other things? Commented Mar 10, 2016 at 14:39
  • If you need to do this regularly, you can place your bin in cron.* folder (there is other solutions) Commented Mar 10, 2016 at 15:00
  • I don't understand. It's in linux Commented Mar 10, 2016 at 15:02

3 Answers 3

Reset to default
3

It turns out it isn't that bad. You have to:

  1. Create a raw socket, if you haven't already. You can do it with an ICMP socket or well, just about any IPPROTO you want. I've tested it with an ICMP socket.

int sd = socket(PF_INET, SOCK_RAW, IPPROTO_ICMP);

  1. Get a sockaddr of the IP you want to flush from the cache. You can do this with gethostbyname, or a variety of mechanisms. I'll call our address hostaddy

  2. Create an arpreq struct, and make all fields zero except the arp_pa field.

struct arpreq ar; memset(&ar, 0, sizeof(ar)); memcpy(&ar.arp_pa, hostaddy, sizeof( struct sockaddr_in ) );

  1. Call ioctl on the socket and structure, with SIOCDARP.

int ret = ioctl( sd, SIOCDARP, &ar ); if( ret ) fprintf( stderr, "Failed to clear entry.\n" );

  1. Don't forget to close your socket if you don't plan on using it anymore close(sd)

Sources: (1) strace arp -d <ip> (2) https://svn.nmap.org/nmap/libdnet-stripped/src/arp-ioctl.c

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

0

ARP cache may be contained in one of the following files (there is no official recommandation):

/proc/net/arp
/etc/networks
/etc/hosts
/etc/ethers

You can access this file by program and do whatever you want with.

Improve this answer

2 Comments

Thanks!I edit the question to make it more clearly. Are there functions avaliable to clear arp cache?
No, you should access to these file with the langage I/O functions you use (fopen(), fread() in C, etc...)
0

Here is my example how I made it for python:

import fcntl
import socket
import struct
import ipaddress

def clear_arp(ip, ifname=''):
    while True:
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)    
            ip_bytes = int(ipaddress.IPv4Address(ip)).to_bytes(4, byteorder='big')
            fcntl.ioctl(
                sock.fileno(),
                    0x8953, # SIOCDARP
                    struct.pack('hh48s16s', socket.AF_INET, 0, ip_bytes, ifname[:15].encode())
                )
        except OSError as e:
            break
        finally:
            sock.close()

                    struct.pack('hh48s16s', socket.AF_INET, 0, ip_bytes, ifname[:15].encode())
                )
        except OSError as e:
            break
        finally:
            sock.close()
Improve this answer

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.