ARP

ARP

The ARP.EXE utility is used to view and manipulate the ARP cache. The Platform SDK sample that emulates ARP.EXE by using the IP Helper functions is named IPARP.EXE. ARP (which, as you'll recall, stands for address resolution protocol) is responsible for resolving an IPv4 address to a physical MAC address. Machines cache this information for performance reasons, and it is possible to access it through the ARP.EXE utility. Using this utility, you can display the ARP table with the -a option, delete an entry with the -d option, or add an entry with the -s option. In the next section, we will describe how to print the ARP cache, add an entry to the ARP table, and delete ARP entries.

All of the IP Helper functions discussed in this section are available in Windows 98, Windows Me, and Windows NT 4.0 (Service Pack 4 or later).

The simplest function is obtaining the ARP table. The IP Helper function that obtains this table is GetIpNetTable, which is defined as

DWORD GetIpNetTable (      PMIB_IPNETTABLE pIpNetTable,      PULONG          pdwSize,     BOOL            bOrder );

The first parameter, pIpNetTable, is a pointer to an MIB_IPNETTABLE structure that returns the ARP information. You must supply a sufficiently large buffer when calling this function. As with most other IP Helper functions, passing NULL for this parameter will return the buffer size needed as the parameter pdwSize and the error ERROR_INSUFFICIENT_BUFFER. Otherwise, pdwSize indicates the size of the buffer passed as pIpNetTable. The last parameter, bOrder, indicates whether the returned IPv4 entries should be sorted in ascending IPv4 order.

The MIB_IPNETTABLE structure is a wrapper for an array of MIB_IPNETROW structures and is defined as

typedef struct _MIB_IPNETTABLE  {      DWORD        dwNumEntries;      MIB_IPNETROW table[ANY_SIZE];  } MIB_IPNETTABLE, *PMIB_IPNETTABLE;

The dwNumEntries field indicates the number of array entries present in the table field. The MIB_IPNETROW structure contains the actual ARP entry information and is defined as

typedef struct _MIB_IPNETROW {      DWORD dwIndex;      DWORD dwPhysAddrLen;     BYTE  bPhysAddr[MAXLEN_PHYSADDR];     DWORD dwAddr;     DWORD dwType; } MIB_IPNETROW, *PMIB_IPNETROW;

The fields of this structure are as follows:

• dwIndex Specifies the index of the adapter.

• dwPhysAddrLen Indicates the length, in bytes, of the physical address contained in the bPhysAddr field.

• bPhysAddr Is an array of bytes that contains the physical (MAC) address of the adapter.

• dwAddr Specifies the IP address of the adapter.

• dwType Indicates the type of the ARP entry. Table 16-12 shows the possible values for this field.

Table 16-12 Possible ARP Entry Types

ARP Type	Meaning
MIB_IPNET_TYPE_STATIC	Static entry
MIB_IPNET_TYPE_DYNAMIC	Dynamic entry
MIB_IPNET_TYPE_INVALID	Invalid entry
MIB_IPNET_TYPE_OTHER	Other entry

Adding an ARP Entry

The next function of ARP is adding an entry to the ARP cache, which is another relatively simple operation. The IP Helper function to add an ARP entry is SetIpNetEntry and is defined as

DWORD SetIpNetEntry (      PMIB_IPNETROW pArpEntry  );

The only argument is the MIB_IPNETROW structure, which we covered in the previous section. To add an ARP entry, simply fill in the structure with the new ARP information. First, you need to set the dwIndex field to the index of a local IPv4 address that indicates the network on which the ARP entry applies. Remember that if you are given the IP address, you can map the IP to the index with the GetIpAddrTable function. The next field, dwPhysAddrLen, is typically set to 6. (Most physical addresses, such as ETHERNET MAC addresses, are 6 bytes long.) The bPhysAddr byte array must be set to the physical address. Most MAC addresses are represented as 12 characters—for example, 00-A0-C9-A7-86-E8. These characters need to be encoded into the proper byte array locations of the bPhysAddr field. For example, the sample MAC address would be encoded into the following bytes:

00000000 10100000 11001001 10100111 10000110 11101000

The encoding method is the same used for encoding IPX and ATM addresses. (See Chapter 4 for more information.) The dwAddr field must be set to the IP address that belongs to the remote host and the specified MAC address. The last field, dwType, is set to one of the ARP entry types listed in Table 16-12. Once the structure is filled, call SetIpNetEntry to add the ARP entry to the cache. Upon success, NO_ERROR is returned.

Deleting an ARP Entry

Deleting an ARP entry is similar to adding one except that the only information required is the interface index, dwIndex, and the IPv4 address of the ARP entry to delete, dwAddr. The function to remove an ARP entry is DeleteIpNetEntry, which is defined as

DWORD DeleteIpNetEntry (      PMIB_IPNETROW pArpEntry  );

Again, the only parameter is an MIB_IPNETROW structure, and the only information necessary for removing an ARP entry is the local IPv4 index and the IPv4 address of the entry to delete. Remember that the index number to a local IPv4 interface can be obtained with the function GetIpAddrTable. Upon success, NO_ERROR is returned.

Sending an ARP Request

It is sometimes useful to send an ARP request to populate the ARP cache with the physical address of a destination. For example, sending a UDP datagram larger than the link MTU to a destination that is not in the ARP cache will always fail; on IPv4 it will fail silently and IPv6 will indicate an error. The SendArp function will attempt to resolve the given IPv4 address to its MAC address. There is no IPv6 equivalent function but at least IPv6 will indicate that an error has occurred so that the application can retransmit the packet once the physical address has been resolved. The function is declared as

DWORD SendArp( IPAddr DestIP, IPAddr SrcIP, PULONG pMacAddr, PULONG PhyAddrLen );

The DestIP indicates the IPv4 destination address that ARP will attempt to resolve. SrcIP is the optional local IPv4 interface to send the ARP request on. If zero, the routing table will determine which local interface to use. pMacAddr is a data buffer that receives the destination's physical address. Lastly, PHyAddrLen will indicate the length of the physical address returned in the pMacAddr buffer.