awk — ARP & VLAN

Parse ARP table — IP, MAC, interface, state

ip neigh | awk '{printf "%-16s %-18s %-8s %s\n",$1,$5,$3,$NF}'

Only reachable ARP entries

ip neigh | awk '/REACHABLE/ {print $1, $5}'

Count ARP entries per interface

ip neigh | awk '{iface[$3]++} END{for(i in iface) printf "%-10s %d entries\n",i,iface[i]}'

Detect duplicate MACs in ARP — possible spoofing

ip neigh | awk '$5 ~ /:/ {mac[$5]=mac[$5] ? mac[$5]", "$1 : $1; count[$5]++} END{for(m in count) if(count[m]>1) printf "%-18s -> %s\n",m,mac[m]}'

Count hosts per /24 subnet from ARP neighbors

ip neigh | awk -F'[ .]' '{subnet=$1"."$2"."$3".0/24"; count[subnet]++} END{for(s in count) printf "%-18s %d hosts\n",s,count[s]}' | sort -t'.' -k1,1n -k2,2n -k3,3n