Display, Add and Remove Arp Information with Windows Arp Command


Arp is a protocol used to determine host IP addresses from their physical MAC or Ethernet address. Windows operating systems provides arp command in order to manage arp related information. With arp command we can display, add and remove arp entries in ARP cache.

ARP Cache

ARP and IP entries are hold  in ARP cache every time we want to communicate over network and need IP address we look to the ARP cache. ARP cache is populated with ARP request or manually with static ARP entries

ARP Entry Types

ARP cache have two type of entries. They are called static and dynamic .

Dynamic ARP entry

Dynamic entries are populated by operating system after ARP request. The returned ARP responses are put into the ARP cache.

Static ARP Entry

Static entries are populated by manually without any network traffic and can be removed manually which means not deleted automatically after specific duration.

List and Display ARP Entries

We can list currently available ARP entries in cache with -a option. This will list entries according to related interfaces. In this example we have two interfaces and this will create two table

List and Display ARP Entries
List and Display ARP Entries

Add Static ARP Entry

Another useful feature of arp command is adding static ARP entries. This will add a given IP address and Mac address to the ARP cache. This entry will be stored up to the computer restart. This type of entries also listed as Type static while listing entries. We will provide the IP address and the mac address like below. We will use -s parameter.

> arp -s 192.168.122.50 00-aa-00-62-c6-09
Add Static ARP Entry
Add Static ARP Entry

We can see the entry as static type.

Remove ARP Entry

We can also remove existing ARP entries. The entry type can be static or dynamic . We will use -d option and the IP address of the entry we want to delete. In this example we will remove ARP entry related with IP address 192.168.122.50 .

> arp -d 192.168.122.50
Remove ARP Entry
Remove ARP Entry

LEARN MORE  Ettercap Tutorial For Network Sniffing and Man In The Middle

Leave a Comment