The arp Command

The arp Command

The arp command is similar to the show arp command on a Cisco Internetwork Operating System (IOS) based router. This command can be used to display or edit the Address Resolution Protocol (ARP) cache on a Windows computer. arp is used for mapping IP addresses to the hardware address of a network interface. TCP/IP transmissions on a Layer 2 network are preceded by an ARP request that is used to discover the hardware address (MAC address) of the destination device using a particular IP address. Let's look at the syntaxes for the ARP command that you should know for the exam.

The -a syntax displays all the entries in the ARP Cache. Only the IP address and physical addresses for the computer are displayed.

 C:\>  arp -a  Interface: 172.16.1.33 on Interface 0x1000004   Internet Address      Physical Address      Type   172.16.0.1            00-d0-9e-58-94-71     dynamic C:\> 

The -d syntax is used to delete an entry specified by the IP address given. The following output shows the router at 172.16.0.1 being removed from the ARP Cache.

 C:\>  arp -d 172.16.0.1  C:\> 

To statically map an IP address to a MAC address in the ARP cache, you can use the -s syntax. You must manually enter the host's IP address and MAC address; the MAC address is specified as six hexadecimal bytes separated by hyphens. The IP address is specified in the standard dotted decimal notation. In the cache table, the new entry is shown as a static entry and set to never time-out. The following output shows the IP address 10.1.1.212 being mapped to the MAC address of 00.dd.03.62.c3.aa.

 C:\  arp -s 10.1.1.212   00-dd-03-62-c3-aa