Address Resolution Protocol

Address Resolution Protocol (ARP) performs IP address-to-MAC-address resolution for outgoing packets. As each outgoing IP datagram is encapsulated into a frame, source and destination MAC addresses must be added. Determining the destination MAC address for each frame is the responsibility of ARP.

ARP compares the destination IP address on every outbound IP datagram to the ARP cache for the NIC which that frame will be sent over. If there is a matching entry, then the MAC address is retrieved from the cache. If not, ARP broadcasts an ARP Request Packet onto the local subnet, requesting that the owner of the IP address in question reply with its MAC address. If the packet is going through a router, ARP resolves the MAC address for that next-hop router rather than for the final destination host. When an ARP reply is received, the ARP cache is updated with the new information, and it is used to address the packet at the link layer.

ARP Cache

You can view, add, or delete entries in the ARP cache using the arp utility (see the following examples). Entries added manually are static, and do not get aged out of the cache like dynamic entries do.

To view the ARP cache, type the following command; you will get results similar to those in the following example:

C:\>arp -a Interface: 172.16.112.123 Internet Address Physical Address Type 172.16.112.1 00-00-0c-1a-eb-c5 dynamic 172.16.112.124 00-dd-01-07-57-15 dynamic Interface: 172.16.113.190 Internet Address Physical Address Type 172.16.113.138 00-20-af-1d-2b-91 dynamic

In these examples, the computer is multihomed, meaning that it has multiple NICs, so there is a separate ARP cache for each interface. The arp-s command can be used to add a static entry to the ARP cache used by the second interface, for the host whose IP address is 172.16.90.32 and whose NIC address is 00608C0E6C6A, as shown in the following example:

C:\>arp -s 172.16.90.32 00-60-8c-0e-6c-6a 172.16.48.190 C:\>arp -a Interface: 172.16.112.123 Internet Address Physical Address Type 172.16.112.1 00-00-0c-1a-eb-c5 dynamic 172.16.112.124 00-dd-01-07-57-15 dynamic Interface:172.16.48.190 Internet Address Physical Address Type 172.16.80.138 00-20-af-1d-2b-91 dynamic 172.16.90.32 00-60-8c-0e-6c-6a static

ARP Cache Aging

Windows NT versions 4.0 and 3.5x adjust the size of the ARP cache automatically. Entries are aged out of the ARP cache if they are not used by any outgoing datagrams for two minutes. Entries that are being referenced get aged out of the ARP cache after 10 minutes. Entries added manually are not aged out of the cache. A new registry parameter, ArpCacheLife, was added to allow more administrative control over aging. This parameter is described in online Registry Help.

Entries can be deleted from the cache using arp -d as shown next:

C:\>arp -d 172.16.90.32 C:\>arp -a Interface: 172.16.112.123 Internet Address Physical Address Type 172.16.112.1 00-00-0c-1a-eb-c5 dynamic 172.16.112.124 00-dd-01-07-57-15 dynamic Interface: 172.16.112.190 Internet Address Physical Address Type 172.16.112.138 00-20-af-1d-2b-91 dynamic

ARP will queue one outbound IP datagram to a given destination address while that IP address is being resolved to a MAC address. If a UDP – based program sends multiple IP datagrams to a single destination address without any pauses between them, some of the datagrams may be dropped if there is no ARP cache entry already present.