Check and Clean Up Legacy RARP Entries with rarp

rarp inspects and edits the kernel's old Reverse Address Resolution Protocol table, a table no modern Linux kernel actually implements any more. This guide shows how to check the system RARP table, use the legacy commands for adding and removing mappings, and recognise a kernel that cannot perform the operation at all. This is an administration command from the net-tools package, version 2.10-0.1ubuntu4.4 on the system used for this guide.

Allow about 10 minutes for inspection. Changing a live table needs a maintenance window and a tested recovery command.

Before you start

RARP, the Reverse Address Resolution Protocol, let some machines discover their own address from a hardware address during boot. It is obsolete on modern Linux: the local rarp(8) manual says Linux kernels have carried no RARP support since kernel version 2.3. The command can still be installed because it is part of the compatibility-oriented net-tools package, but installing it does not restore kernel support.

Use an account that can run ordinary inspection commands. Listing may work without elevated privileges, while adding or deleting a kernel table entry normally needs root. If the command reports that the kernel does not support RARP, stop there, do not try to work around that message by repeatedly adding entries.

1. Confirm the command and version

Check the installed implementation before relying on its behaviour:

command -v rarp
rarp -V

On this machine the executable is /usr/sbin/rarp, and the program reports net-tools 2.10. The installed Debian package is net-tools 2.10-0.1ubuntu4.4. The package version and the program version are related but not identical strings, so record both when troubleshooting a mixed or customised installation.

The help output on this build also mentions options the supplied manual page does not describe. This guide sticks to the documented interface: -a, -d, -s, -t, -v, and the version and help switches. Do not copy an option from another release without checking your own installed binary.

2. List the RARP table

Ask the kernel for the current table:

rarp -a

The documented short form is -a, the manual also lists the long form --list. A supported system returns the entries the kernel knows about. That output is the evidence to save before making any change, so redirect it to a temporary file if you are investigating an old host:

rarp -a 2>/tmp/rarp-list.err | tee /tmp/rarp-list.txt
status=${PIPESTATUS[0]}
test "$status" -eq 0

On a current Linux kernel, expect the failure This kernel does not support RARP. with a non-zero status. That is a compatibility result, not proof the rarp executable is missing. The presence of /proc/net/rarp is another useful check, but a missing file alone is not a reason to create one.

3. Understand an entry before changing it

The set form is rarp -s hostname hw_addr. For Ethernet, the hardware address is six hexadecimal bytes separated by colons. The optional -t type selects the hardware class, defaulting to ether, hardware code 0x01. The manual also mentions ax25 and netrom as possible classes, though the available classes depend on the program and kernel.

Do not treat a hostname here as a harmless label. It identifies the host the mapping is created for, and some older systems used a RARP reply as part of network boot, so adding an entry can affect boot behaviour and surprise the network team.

If the kernel supports RARP and you have a verified change request, the following is the shape of a root command. Replace both placeholders with values from your change record:

sudo rarp -v -s HOSTNAME 02:00:00:12:34:56

-v asks for progress information. It does not make an unsupported kernel support RARP, and it does not validate that the hardware address belongs to the intended machine.

4. Remove a mapping and recover

The delete form removes all RARP entries for the named host. This is a state-changing operation and needs elevated privileges on systems that still implement the table:

sudo rarp -v -d HOSTNAME

sudo rarp -v -t ether -s HOSTNAME 02:00:00:12:34:56

That recovery only applies when the kernel supports RARP in the first place. On this machine both listing and modification fail with the same unsupported-kernel message, so there is no live RARP table to clean up. If a service or boot process still expects RARP, find its replacement or migration plan rather than forcing this utility into service.

Common traps

• Confusing package presence with support: dpkg -s net-tools proves the user-space package is installed, not that the kernel implements RARP.
• Using the wrong address format: Ethernet uses six hexadecimal octets separated by colons, and the format is hardware-class dependent.
• Deleting a name too broadly: -d removes every entry for the specified host, so check spelling and table output first.
• Assuming a successful-looking command is enough: check the exit status, then run rarp -a again. A non-zero status or an unsupported-kernel message means the requested state was never established.