How do I install the X Arp skill?

Run npx skillmds@latest add x-cmd/x-arp in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is X Arp safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with X Arp?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is X Arp free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

x-cmd (@x-cmd) published this skill. Their other Agent Skills are listed on their SkillMD profile.

X Arp by x-cmd — Agent Skill

Name: X Arp
Author: x-cmd

X Arp

Display ARP cache table with MAC vendor lookup and suspicious entry detection. Supports CSV, TSV, and TUI output. **Dependency**: This is an x-cmd module. Install x-cmd first (see x-cmd skill for installation options). see x-cmd skill for installation.

x-cmd 0f230d1 10 files · 7.9 KB Updated Sep 17, 2026

File contents

x arp - ARP Cache Table Viewer

Display and inspect the local system's ARP cache table with multiple output formats.

Quick Start

# Interactive ARP table viewer (default in TTY)
x arp

# TSV format output (default when piped)
x arp | cat

Features

Multi-format output: TSV, CSV, TUI application, raw
MAC vendor lookup: Automatic vendor identification
Suspicious entry detection: Flags potentially suspicious entries
Cross-platform: Linux, macOS, Windows support

Output Fields

Field	Description	Example
`ip`	IP address	`192.168.1.1`
`mac`	MAC address	`00:11:22:33:44:55`
`if`	Network interface	`eth0`, `en0`
`suspicious`	Suspicious flag	Yes/No
`scope`	Address scope	`link`, `global`
`type`	Entry type	`static`, `dynamic`
`vendor`	MAC vendor (if available)	`Apple, Inc.`

Commands

Command	Description
`x arp`	Auto mode: TTY→interactive, pipe→TSV
`x arp --app`	Interactive TUI view
`x arp --csv`	CSV format output
`x arp --tsv`	TSV format output
`x arp --raw`	Raw system command output
`x arp --all`	Include incomplete entries
`x arp --no-vendor`	Skip MAC vendor lookup

Examples

Basic Usage

# Interactive view (TTY)
x arp

# TSV format
x arp --tsv

# CSV format
x arp --csv

Filtering and Processing

# Find entries for specific IP
x arp --tsv | awk -F'\t' '$1 == "192.168.1.1"'

# Check for suspicious entries
x arp --tsv | grep "Yes"

# Get all entries including incomplete
x arp --all

Network Troubleshooting

# View raw ARP output
x arp --raw

# Check specific interface
x arp --tsv | grep "eth0"

Platform Notes

Linux

Uses ip neigh or arp -n
Full feature support

macOS

Uses arp -an
Full feature support

Windows

Uses arp -a
Full feature support

Security Notes

Suspicious entries: Flags entries that may indicate ARP spoofing
MAC vendor: Helps identify unknown devices on network
Use --no-vendor for faster output without network lookup

Native arp(8) manual page

---name: x-arpdescription: Display ARP cache table with MAC vendor lookup and suspicious entry detection. Supports CSV, TSV, and TUI output. **Dependency**: This is an x-cmd module. Install x-cmd first (see x-cmd skill for installation options). see x-cmd skill for installation.license: Apache-2.0---# x arp - ARP Cache Table Viewer> Display and inspect the local system's ARP cache table with multiple output formats.---## Quick Start```bash# Interactive ARP table viewer (default in TTY)x arp# TSV format output (default when piped)x arp | cat```---## Features- **Multi-format output**: TSV, CSV, TUI application, raw- **MAC vendor lookup**: Automatic vendor identification- **Suspicious entry detection**: Flags potentially suspicious entries- **Cross-platform**: Linux, macOS, Windows support---## Output Fields| Field | Description | Example ||-------|-------------|---------|| `ip` | IP address | `192.168.1.1` || `mac` | MAC address | `00:11:22:33:44:55` || `if` | Network interface | `eth0`, `en0` || `suspicious` | Suspicious flag | Yes/No || `scope` | Address scope | `link`, `global` || `type` | Entry type | `static`, `dynamic` || `vendor` | MAC vendor (if available) | `Apple, Inc.` |---## Commands| Command | Description ||---------|-------------|| `x arp` | Auto mode: TTY→interactive, pipe→TSV || `x arp --app` | Interactive TUI view || `x arp --csv` | CSV format output || `x arp --tsv` | TSV format output || `x arp --raw` | Raw system command output || `x arp --all` | Include incomplete entries || `x arp --no-vendor` | Skip MAC vendor lookup |---## Examples### Basic Usage```bash# Interactive view (TTY)x arp# TSV formatx arp --tsv# CSV formatx arp --csv```### Filtering and Processing```bash# Find entries for specific IPx arp --tsv | awk -F'\t' '$1 == "192.168.1.1"'# Check for suspicious entriesx arp --tsv | grep "Yes"# Get all entries including incompletex arp --all```### Network Troubleshooting```bash# View raw ARP outputx arp --raw# Check specific interfacex arp --tsv | grep "eth0"```---## Platform Notes### Linux- Uses `ip neigh` or `arp -n`- Full feature support### macOS- Uses `arp -an`- Full feature support### Windows- Uses `arp -a`- Full feature support---## Security Notes- **Suspicious entries**: Flags entries that may indicate ARP spoofing- **MAC vendor**: Helps identify unknown devices on network- Use `--no-vendor` for faster output without network lookup---## Related- Native `arp(8)` manual page

Frequently asked questions