ARP

The Arp.exe utility is used to view and manipulate the ARP cache. The Platform SDK sample that emulates Arp.exe by using the IP Helper functions is named Iparp.exe. ARP (which, as you'll recall, stands for address resolution protocol) is responsible for resolving an IP address to a physical MAC address. Machines cache this information for performance reasons, and it is possible to access this information through the Arp.exe utility. Using this utility, you can display the ARP table with the -a option, delete an entry with the -d option, or add an entry with the -s option. In the next section, we will describe how to print the ARP cache, add an entry to the ARP table, and delete ARP entries.

All the IP Helper functions discussed in this section are available on Windows 98, Windows 2000, and Windows NT 4 Service Pack 4 (or later).

The simplest function is obtaining the ARP table. The IP Helper function that obtains this table is GetIpNetTable, which is defined as

 DWORD GetIpNetTable ( PMIB_IPNETTABLE pIpNetTable, PULONG pdwSize, BOOL bOrder ); 

The first parameter, pIpNetTable, is a pointer to an MIB_IPNETTABLE structure that returns the ARP information. You must supply a sufficiently large buffer when calling this function. As with most other IP Helper functions, passing NULL for this parameter will return the buffer size needed as the parameter pdwSize and the error ERROR_INSUFFICIENT_BUFFER. Otherwise, pdwSize indicates the size of the buffer passed as pIpNetTable. The last parameter, bOrder, indicates whether the returned IP entries should be sorted in ascending IP order.

The MIB_IPNETTABLE structure is a wrapper for an array of MIB_IPNETROW structures and is defined as

 typedef struct _MIB_IPNETTABLE { DWORD dwNumEntries; MIB_IPNETROW table[ANY_SIZE]; } MIB_IPNETTABLE, *PMIB_IPNETTABLE; 

The dwNumEntries field indicates the number of array entries present in the table field. The MIB_IPNETROW structure contains the actual ARP entry information and is defined as

 typedef struct _MIB_IPNETROW { DWORD dwIndex; DWORD dwPhysAddrLen; BYTE bPhysAddr[MAXLEN_PHYSADDR]; DWORD dwAddr; DWORD dwType; } MIB_IPNETROW, *PMIB_IPNETROW; 

The fields of this structure are as follows:

• dwIndex Specifies the index of the adapter.
• dwPhysAddrLen Indicates the length, in bytes, of the physical address contained in the bPhysAddr field.
• bPhysAddr Is an array of bytes that contains the physical (MAC) address of the adapter.
• dwAddr Specifies the IP address of the adapter.
• dwType Indicates the type of the ARP entry. Table B-6 shows the possible values for this field.

Table B-6. Possible ARP entry types

ARP Type	Meaning
MIB_IPNET_TYPE_STATIC	Static entry
MIB_IPNET_TYPE_DYNAMIC	Dynamic entry
MIB_IPNET_TYPE_INVALID	Invalid entry
MIB_IPNET_TYPE_OTHER	Other entry

Adding an ARP Entry

The next function of ARP is adding an entry to the ARP cache, which is another relatively simple operation. The IP Helper function to add an ARP entry is SetIpNetEntry and is defined as

 DWORD SetIpNetEntry ( PMIB_IPNETROW pArpEntry ); 

The only argument is the MIB_IPNETROW structure, which we covered in the previous section. To add an ARP entry, simply fill in the structure with the new ARP information. First you need to set the dwIndex field to the index of a local IP address that indicates the network on which the ARP entry applies. Remember that if you are given the IP address, you can map the IP to the index with the GetIpAddrTable function. The next field, dwPhysAddrLen, is typically set to 6. (Most physical addresses, such as ETHERNET MAC addresses, are 6 bytes in length.) The bPhysAddr byte array must be set to the physical address. Most MAC addresses are represented as 12 characters—for example, 00-A0-C9-A7-86-E8. These characters need to be encoded into the proper byte array locations of the bPhysAddr field. For example, the sample MAC address would be encoded into the following bytes:

 00000000 10100000 11001001 10100111 10000110 11101000 

The encoding method is the same used for encoding IPX and ATM addresses. (See Chapter 6 for more information.) The dwAddr field must be set to the IP address of the remote host you are entering the MAC address of. The last field, dwType, is set to one of the ARP entry types listed in Table B-6. Once the structure is filled, call SetIpNetEntry to add the ARP entry to the cache. Upon success, NO_ERROR is returned.

Deleting an ARP Entry

Deleting an ARP entry is similar to adding one except that the only information required is the interface index, dwIndex, and the IP address of the ARP entry to delete, dwAddr. The function to remove an ARP entry is DeleteIpNetEntry, which is defined as

 DWORD DeleteIpNetEntry ( PMIB_IPNETROW pArpEntry ); 

Again, the only parameter is an MIB_IPNETROW structure, and the only information necessary for removing an ARP entry is the local IP index and the IP address of the entry to delete. Remember that the index number to a local IP interface can be obtained with the function GetIpAddrTable. Upon success, NO_ERROR is returned.