The Address Resolution Protocol (ARP) is used to resolve IP addresses to MAC addresses. This is important because on a network, devices find each other using the IP address, but communication between devices requires the MAC address.

When a computer wants to send data to another computer on the network, it must know the MAC address of the destination system. To discover this information, ARP sends out a discovery packet to obtain the MAC address. When the destination computer is found, it sends its MAC address to the sending computer. The ARP-resolved MAC addresses are stored temporarily on a computer system in the ARP cache. Inside this ARP cache is a list of matching MAC and IP addresses. This ARP cache is checked before a discovery packet is sent on to the network to determine if there is an existing entry.

Entries in the ARP cache are periodically flushed so that the cache doesn't fill up with unused entries. The following code shows an example of the ARP command with the output from a Windows 2000 system:

C:\>arp -a
Interface: on Interface 0x3
  Internet Address      Physical Address      Type           00-00-77-93-d8-3d     dynamic

As you might notice in the previous code, the type is listed as dynamic. Entries in the ARP cache can be added statically or dynamically. Static entries are added manually and do not expire. The dynamic entries are added automatically when the system accesses another on the network.

As with other command-line utilities, there are several switches available for the arp command. Table 4 shows the available switches for Windows-based systems.

Table 4 ARP Switches



-a or -g

Displays both the IP and MAC addresses and whether they are dynamic or static entries


Specifies a specific internet address

-N if_addr

Displays the ARP entries for a specified network interface


Specifies a MAC address


Specifies an Internet address


Deletes an entry from the ARP cache


Adds a static permanent address to the ARP cache