4.11 ARP Protocol
ARP is the Internet layer protocol responsible for determining the MAC (hardware)
address that corresponds to a particular IP address. The ARP command allows the user
to view the current contents of the ARP cache of the local computer (residing on the
same network) or remote computer (residing on the different network) through a router.
Microsoft includes the ARP.EXE utility for viewing and modifying the ARP cache with its
Windows products. The following ARP commands can be used to view cache entries:
•
arp –a
➞
Use this command to view all ARP cache entries.
•
arp –a
plus
IP address
➞
Use this command to view ARP cache entries associated
with one particular interface on a network with multiple adapters.
•
arp –g
➞
Same as arp –a.
•
arp –N
➞
Use this command to display ARP entries for specific network interface.
•
arp – s
plus
IP address
plus
Physical address
➞
Use this command to manually add
a permanent static entry to the ARP cache.
•
arp –d
➞
Use this command to manually delete a static entry.
Ping the destination computer using IP address first before using the arp -a
command.
The following window shows examples of arp commands and responses.
• Your computer has an IP address of
192.168.1.118
• The destination computer has an IP address of
192.168.1.96
Figure 4.18 ARP Commands and Responses
C:\>arp - 192.168.1.96
No ARP Entries Found
C:\>ping 192.168.1.96
Pinging 192.168.1.96 with 32 bytes of data:
Reply from 192.168.1.96=bytes=32 time=5ms TTL=32
Reply from 192.168.1.96=bytes=32 time=3ms TTL=32
Reply from 192.168.1.96=bytes=32 time=3ms TTL=32
Reply from 192.168.1.96=bytes=32 time=4ms TTL=32
C:\>arp -a 192.168.1.96
Interface: 192.168.1.118
Internet Address
Physical Addresss
Type
192.168.1.96
00-03-34-00-00-23
dynamic
C:\>arp -s 192.168.1.96 00-03-34-00-00-23
C:\>arp -a 192.168.1.96
Interface: 192.168.1.118
Internet Address
Physical Addresss
Type
192.168.1.96
00-03-34-00-00-23
static
C:\>arp -d 192.168.1.96
C:\>arp -a 192.168.1.96
No ARP Entries Found
C:\>
29
