Showing results for 
Search instead for 
Did you mean: 
Level 11

How to display sensor ARP cache


During a recent attempt at gathering knowledge to assist in troubleshooting (see this post), I wanted to view the local ARP cache on a sensor.  Although it would appear to have the information, it doesnt appear to want to give me it.  From the CLI guide (we are running version 7.5):

arp dump

"Dumps the contents of the current MAC/IP address mapping table in the database to a debug file. This command is used for debugging purposes. Use with the logstat (on page 56) command to provide a diagnostic trace to supply to Technical Support."


"Logs certain internal statistics of the Sensor which you can supply to Technical Support using the Manager's Diagnostics Trace feature. This command is used only for troubleshooting purposes in conjunction with the Technical Support."

Diagnostics trace creates an encrypted zip that then needs to be passed to McAfee.  As far as I can see, there is no way of displaying what should be a reasonably simple thing to display.  I am hoping I am incorrect - can anybody shed some light on either a)how to achieve this or b)the logic that led to customers not being able to troubleshoot...

Thanks in advance!

0 Kudos