5

The Linux kernel generally tends to cache its ARP tables here:
/proc/net/arp.
Darwin & Mac OS X, however, do not seem to follow the same convention.
So where can I find the Darwin & Mac OS X equivalent of:
/proc/net/arp?

2

OS X doesn't cache things on /proc so there's no equivalent exposure of kernel data through the filesystem idiom.

You can call arp -a to dump the current table to the location of your choosing if that sort of DIY caching has benefits for your code or use case.

  • That's actually what led me to ask the question; whilst experimenting with the arp command i noticed a significant lag/delay between the initiation of peer network traffic/activity and the subsequent reflection of resolved, live hosts by arp -a. My hope was that cat /proc/net/arp (or something similar) might be more responsive. – voices Sep 10 '15 at 2:40
  • 1
    @tjt263 No such luck. You'd need to attach to the kernel and grab the internal state unless someone knows how to send a unix signal to the process to dump a debug portion of the stack. It might be possible, but unless Apple engineering documents it or someone susses it out, you might be stuck running the command to regenerate the list (-a causes a flush and then reports back the results). You could also craft a tcpdump and/or just log the arp results if you needed a pseudo file that was somewhat regularly kept up to date. – bmike Sep 10 '15 at 3:55
  • I thought that sudo ping -c 10 255.255.255.255 && arp -a might do the trick (a la ICMP/ping sweep). It doesn't seem to even TRY pinging ALL the available (or potentially available) hosts though.. – voices Sep 14 '15 at 9:53
  • 1
    I don't think that ping command is supposed to try all available hosts, it's just going to send out one packet with that IP address in the destination field and leave it to the switches to flood it out all their ports (which they would do for any IP address not in their ARP cache anyway). – ash Jan 25 '16 at 16:38
1

It looks like the cache on OS X isn't stored anywhere. An inspection of the arp command reveals no open data files during runtime, and man 4 arp claims that the cache is dynamically created.

  • 1
    The mach kernel is the reason for the data structure being isolated from the filesystem. – bmike Sep 9 '15 at 20:02
  • How exactly did you inspect the arp command? – voices Sep 10 '15 at 2:43
  • I did "arp -a & lsof /|grep arp". You may have to run it a few times to get anything. It depends on at which point in arp's execution lsof catches it. It seems that arp also opens the hosts file for a split second, which you may or may not notice, again for the same reasons. – William T Froggard Sep 10 '15 at 14:53
  • Where is the hosts file? /proc/net/hosts? – voices Sep 14 '15 at 10:06
  • 1
    There is no proc directory on OS X. It's /etc/hosts – William T Froggard Sep 14 '15 at 17:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .