When a computer wants to send data to another computer on the network, it must know the MAC address of the destination system. To discover this information, ARP sends out a discovery packet to obtain the MAC address. When the destination computer is found, it sends its MAC address to the sending computer. The ARP-resolved MAC addresses are stored temporarily on a computer system in the ARP cache. Inside this ARP cache is a list of matching MAC and IP addresses. This ARP cache is checked before a discovery packet is sent on to the network to determine if there is an existing entry.
Entries in the ARP cache are periodically flushed so that the cache doesn't fill up with unused entries. The following code shows an example of the ARP command with the output from a Windows 2000 system:
C:\>arp -a Interface: 24.67.179.22 on Interface 0x3 Internet Address Physical Address Type 24.67.179.1 00-00-77-93-d8-3d dynamic
As you might notice in the previous code, the type is listed as dynamic. Entries in the ARP cache can be added statically or dynamically. Static entries are added manually and do not expire. The dynamic entries are added automatically when the system accesses another on the network.
As with other command-line utilities, there are several switches available for the arp command. Table 4 shows the available switches for Windows-based systems.
|
Switch |
Description |
|---|---|
|
-a or -g |
Displays both the IP and MAC addresses and whether they are dynamic or static entries |
|
inet_addr |
Specifies a specific internet address |
|
-N if_addr |
Displays the ARP entries for a specified network interface |
|
eth_addr |
Specifies a MAC address |
|
if_addr |
Specifies an Internet address |
|
-d |
Deletes an entry from the ARP cache |
|
-s |
Adds a static permanent address to the ARP cache |