What is Address Resolution Protocol-ARP Table

ARP (Address Resolution Protocol) is a Layer2 protocol that is used to translate IP addresses (layer 3 in OSI model ) to MAC addresses (layer 2 in OSI model ), and is used when two hosts on a Local Area Ethernet Network want to communicate with each other.

Of course ARP is used in other Layer 2 networks such as ATM for example, but the main usage of ARP is on Ethernet Networks.

The first time Host A wants to contact Host B, Host A sends an ARP Request (using a broadcast packet) on the LAN. The ARP packet basically asks the following “I have the IP address for Host B and I want to know the MAC address of Host B”.

Host B sees this broadcast packet and replies to Host A with an ARP Reply packet containing host B’s MAC address.

Host A now saves this MAC address/IP address combination in its ARP cache (table) and begins to communicate with host B.

This communication happens with Layer2 MAC Addresses because the two hosts are on the same Layer 2 network.

To display the contents of a host’s ARP cache (table), use “arp -a” on a Windows platform, “arp” on a UNIX platform, and “show arp” on a Cisco IOS platform.

Now, what if the destination host is not on the same Layer 3 subnet of the origin host? In this case, the default gateway router of the origin host will reply to the ARP request and give its own MAC address so the origin host will send its packets to the default gateway in order to reach the destination host.

The default gateway will take the packets and using Layer 3 routing will send the packets to the correct interface in order to reach the destination host (of course the packets can traverse several routers before reaching the final destination).

What is ARP Table ?

An ARP table, also known as an ARP cache, is a data structure used to map network addresses to hardware addresses.

Specifically, it maintains a record of Internet Protocol (IP) addresses and their corresponding Media Access Control (MAC) addresses.

This is essential for communication over a network, as it allows devices to find the physical MAC address of a machine on the local network segment when only the IP address is known.

The ARP table is dynamically maintained by the Address Resolution Protocol (ARP), where IP addresses are resolved to MAC addresses, allowing for proper data routing at the link layer of the OSI model.

Entries in the ARP cache can be statically entered by a user or dynamically resolved by the network protocol.

How to Read ARP Table in Windows and Linux ?

To read the ARP table in Windows and Linux, you can use the following commands:

Windows

– Open the Command Prompt.
– Type the command `arp -a` and press Enter.
– This will display the current ARP table, which includes a list of all IP addresses and their corresponding MAC addresses that your computer has recently interacted with.

Linux

– Open a terminal window.
– Type the command `arp` or `arp -n` and press Enter to view the ARP table.
– Alternatively, you can use the `ip neigh` command by typing `ip neigh show` to display the ARP table.
– The ARP table can also be viewed by reading the file `/proc/net/arp`.

The ARP table entries will show the IP address, MAC address, the interface on which the ARP packet was received, and the state of the entry.

How to Read ARP Table on Cisco Router?

To read the ARP table on a Cisco router, you would typically access the router’s command-line interface (CLI) and use the following command:

show ip arp

This command displays the current IP to MAC address mappings that the router has stored in its ARP table.

The output will typically include the interface through which the router learned the MAC address, the IP address, the MAC address itself, the type of ARP entry, and the age of the entry.

For example, if you’re looking for the ARP entry for a specific IP address, you might use a command like:

show ip arp | include 192.168.1.1

This command will filter the ARP table to show entries only for the IP address 192.168.1.1

Do Computers Have ARP tables?

Yes, computers do have ARP tables. Both Windows and Linux operating systems, as well as other network-capable operating systems, maintain an ARP table.

This table is used to store IP-to-MAC address mappings for hosts that have been contacted recently. 

The ARP table on a computer is crucial for the functioning of the network layer in the OSI model.

When a computer wants to communicate with another device on the same local network (LAN), it needs to know the physical address (MAC address) associated with the target device’s IP address.

Since data packets are actually sent over the physical network using MAC addresses, the ARP table’s role is to provide this necessary mapping.

Here’s a bit more detail on how ARP tables work on computers:

ARP Request

When your computer needs to send a packet to another device on the local network, it first checks its ARP table to see if it already has the MAC address corresponding to the desired IP address.

If it doesn’t, it will send out an ARP request packet to the local network asking “Who has this IP address? Please send me your MAC address.”

ARP Reply

The device with the requested IP address will respond with an ARP reply packet that contains its MAC address.

ARP Table Update

The computer that sent out the request will update its ARP table with this new information. Now it can send the packet to the correct MAC address.

Cache Timeout

ARP table entries are not permanent; they have a timeout value after which they expire. This is to ensure that changes in the network can be accommodated, such as a device being assigned a new IP address.

Manual Management

Users can manually add entries to the ARP table or remove them. In Windows, for example, this can be done using the `arp` command with the `-s` option to add a static entry and the `-d` option to remove an entry.

The ARP table is a fundamental component of IP networking. Without it, computers would not be able to communicate over a local network because they would not be able to resolve IP addresses to the MAC addresses required for the actual data exchange on the Ethernet or other data link layer.