When I want to get arp information about a single ip number or subnet, I have to snmpwalk the whole arp table, as some oid architects had the "great" idea to always insert an interface index before the ip number in the oid. .220.127.116.11.18.104.22.168.1.2.(interface).(ip) , .22.214.171.124.126.96.36.199.1.2.(interface).(ip) , .188.8.131.52.184.108.40.206.1.4.(interface).1.4.(ip) . Or do I miss something ?
ARP is actually per interface. A router has a different network for each interface, and ARP is only relevant for the network (interface) of the IP address. Some OSes actually have multiple ARP tables, and you seem to only see it as a single table when listing ARP for the device, but it is really a different table for each interface.
For example, on a Cisco router, you can use the
show arp command that will list out all the ARP entries for all the ARP tables, or you can use the
show arp <interface> or
show arp <network> commands to show a single ARP table for one of the interfaces.
By using the interface index for SNMP, you can see the ARP table of the interface.
In the meantime i found a solution.
The problem is, that a priori only the target IP is known, but not the interface index, so one can not construct the necessary oid for one arp entry
but as one wants to ask the gateway for this arp entry,
one has anyway to guess the gateway IP (probably something like ip1.ip2.ip3.1), and so one can find the interface index via the oid
With a little bash magic one finally gets
snmpbulkwalk -c public -v 2c -OnQx ip1.ip2.ip3.1 .220.127.116.11.18.104.22.168.1.2.$(snmpget -c public -v 2c -Oqv ip1.ip2.ip3.1 .22.214.171.124.126.96.36.199.1.2.ip1.ip2.ip3.1 | tr -d "\n").ip1.ip2.ip3.ip4