What is the ARP command? How to Use it & Tutorial!

ARP stands for “Address Resolution Protocol” is a protocol for mapping an IP address to a physical MAC address on a local area network.

Basically, ARP is a program used by a computer system to find another computer’s MAC address based on its IP address.

Now you have a question “why do we need MAC address?”

The reason is simple, any local communications would use MAC address, not IP address.

When a computer wants to communicate with another computer on a different network, the IP address would be used. The IP address is like your mailing address while MAC address is like your name.

On a TCP/IP network, every computer is assigned IP address and some local server’ IP addresses are also given to a network client.

Now you’re probably wondering – “How often does your computer use ARP?”.

To demonstrate how ARP works let’s take an example.

ARP Command Example

On a local area network, a client computer tries to contact a server.

Here we are talking about communication between two computers on the same broadcast domain means a local area network. First, the client checks its ARP cache.

ARP cache is a table of IP addresses with their corresponding MAC addresses.

To view a Windows computer’s ARP table, open a command prompt and enter the following command:

arp -a

You can see your computers ARP table in the following output:

Interface: 208.117.86.63 --- 0x5 Internet Address Physical Address Type 208.117.86.1 00-00-5e-00-01-02 dynamic 208.117.86.255 ff-ff-ff-ff-ff-ff static 224.0.0.22 01-00-5e-00-00-16 static 224.0.0.252 01-00-5e-00-00-fc static 239.255.255.250 01-00-5e-7f-ff-fa static

The first column is IP address, a second column is corresponding to the MAC address.

The ARP entry is either static or dynamic.

Static ARP entry is manually added to the ARP cache table. Dynamic entries are what the ARP program gets.

They stay there until the ARP cache timeout has expired. Suppose no entry has been found for the server, the client computer will use ARP to send a message through the whole network.

This is a broadcast message to the local network that says who has the IP address so and so, and whats your MAC address.

When a server hears the broadcast message, they respond “yes” i have that IP address and here is my MAC address.

Now, let’s Break down the ARP Process Step by Step:

The client sends a broadcast message because the destination MAC address is a broadcast address. Simply saying hello! anyone has IP address 192.168.0.10 if you hear me would you please give me your MAC address?, and here is my IP address and MAC address. Other devices hear the broadcast message and discard the ARP packet silently.
When a server hears the message, it sends a unicast message to the client because the destination MAC address and IP address belong to the client.
The client cache the servers MAC address. At the same time, the client updates its cache table for future reference.

ARP Summary

It is a layer 2 protocol that uses a layer 3 IP address to find layer 2 MAC address.
It operates on a LAN or the same broadcast domain because ARP relies on broadcasting.
It uses the ARP table.

ARP Announcements

ARP Announcements are a way to officially “claim” the IP address on the network.

ARP announcement to update other hosts ARP tables without the need for an ARP request. It helps update the network faster when there was a recent change to hosts IP address.

Reverse ARP

A diskless computer that doesn’t have permanent storage would not be able to find its IP address because the IP addresses kept on the computer’s secondary storage.

So how does a diskless computer would determine its IP address?

The RARP protocol uses a physical network address to obtain the computer’s internet address.

RARP is a network layer protocol and It allows any host to obtain its IP address from the server.

The RARP mechanism supplies the target machine’s physical address to uniquely identify the processor and broadcast a RARP request. The server on the network then receives the message, look up the mapping table and replies to the sender.

Once the machine obtains its IP address, it stores the address in the memory. It does not use RARP until its reboot.

Maintenance of the IP addresses is difficult in RARP as each server must be configured with a table of static mapping between the hardware addresses and IP addresses.

RARP is outdated and is replaced by BOOTP and DHCP protocols.

Inverse ARP

Instead of using layer 3 that uses a IP address to find a MAC address, Inverse ARP uses MAC address to find IP addresses.

As this name suggests, Inverse ARP is just inverse of ARP.

It is used for device configuration and is enabled by default in ATM (Asynchronous Transfer Mode) Networks.

It is used to find layer 3 address from layer 2 address like, DLCI in frame relay.

It dynamically maps local DHCP or remote IP addresses when you configure frame relay. When using inverse ARP we know the DLCI or remote router but don’t know its IP address.

How to Use ARP

ARP Command is a TCP/IP utility used for viewing and modifying the local Address Resolution Protocol (ARP) cache.

ARP Cache contains recently resolved MAC addresses of Internet Protocol (IP) hosts on the network.

Run ARP command without any arguements will display a list of the command’s parameters.

arp

You should see the following screen:

You can display the complete ARP cache by running the following command:

arp -a

You should see the following output:

You can also find the ARP cache entry for a specific IP address by specifying the IP address with arp command:

arp -a 208.117.86.1

You should see the following output:

Interface: 208.117.86.63 --- 0x5 Internet Address Physical Address Type 208.117.86.1 00-00-5e-00-01-02 dynamic

Conclusion

In the above guide, we’ve learned what is ARP and how it works. You also learned how to find the ARP cache of your local network and specific IP address.

We hope this will help you to troubleshoot network related problems and if you have any questions, please feel free to leave them below in the comments section!