View the Address Resolution Protocol (ARP) cache

  • Article

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

To view the Address Resolution Protocol (ARP) cache

  1. Open Command Prompt.

  2. At the command prompt, type arp -a.

    For example, if you recently used the ping command to test and verify connectivity from this computer to a host computer at IP address 10.0.0.99, the ARP cache displays the following entry:

    Interface: 10.0.0.1 on Interface 0x1
  Internet Address      Physical Address      Type
  10.0.0.99             00-e0-98-00-7c-dc     dynamic

    In this example, the cache entry indicates that the remote host computer at 10.0.0.99 resolved to a media access control address of 00-e0-98-00-7c-dc assigned in the network adapter hardware of the remote computer. The media access control address is the address that your computer used to physically communicate with this remote TCP/IP host on your network.

Notes

  • To open a command prompt, click Start, point to All programs, point to Accessories, and then click Command prompt.

  • To minimize ARP broadcast traffic on your network, a cache of hardware-to-software address mappings is maintained for future use. This cache contains the following two types of entries:

    • Dynamic ARP cache entries

      These entries are added and deleted automatically during normal use of TCP/IP sessions with remote computers. Dynamic entries age and expire from the cache if not reused within 2 minutes. If a dynamic entry is reused within 2 minutes, it may remain in the cache and age up to a maximum cache life of 10 minutes before being removed or requiring cache renewal by using the ARP broadcast process.

    • Static ARP cache entries

      These entries are added manually by using the arp command with the -s option. Static entries remain in the ARP cache until either the computer is restarted, or the interface is reinitiated. Examples of some of the events that cause an interface to be reinitiated are:

  1. The interface is Disabled, and then Enabled.

  2. The Repair feature is used.

  3. The commands ipconfig /release and ipconfig /renew are given.

  4. The computer awakes from a suspend or hibernation state.

  5. You removed and replugged a network cable or moved a computer out of and back into wireless range.

  6. ARP cache entries can be deleted manually by using the arp command with the -d option.

    Example: arp -d 192.168.0.1
Removes ARP mappings for 192.168.0.1 on all interfaces.

Information about functional differences

  • Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. For more information, see Viewing Help on the Web.

See Also

Concepts

Troubleshooting TCP/IP
Address Resolution Protocol (ARP)
Add a static ARP cache entry
Arp
Command-line utilities