I need to look up MAC address in the local network and I'm using Linux. What I do is send a ARP request with libnet, but after I send 3 requests, the cache still won't update. I use wireshark to catch the packets. From wireshark, I did get 3 ARP replays, after each of my ARP request. Does anyone know how come the ARP cache won't update?
The Linux kernel does not accept unsolicited ARP by default. Since the request was sent by your userspace application and not by the kernel, the kernel sees the reply as "unsolicited".
You can change this default in /proc/sys/net/ipv4/conf/*/arp_accept
(either on a per-device basis or across all devices).