Address Resolution Protocol (ARP) and it's Anatomy

Address Resolution Protocol (ARP) :

• To open a command prompt, click Start, point to All programs, point to Accessories, and then click Command prompt.
  
• To minimize ARP broadcast traffic on your network, a cache of hardware-to-software address mappings is maintained for future use. This cache contains the following two types of entries:
  
  
  • Dynamic ARP cache entries
    
    These entries are added and deleted automatically during normal use of TCP/IP sessions with remote computers. Dynamic entries age and expire from the cache if not reused within 2 minutes. If a dynamic entry is reused within 2 minutes, it may remain in the cache and age up to a maximum cache life of 10 minutes before being removed or requiring cache renewal by using the ARP broadcast process.
    
  • Static ARP cache entries
    
    These entries are added manually by using the arp command with the -s option. Static entries remain in the ARP cache until either the computer is restarted, or the interface is reinitiated. Examples of some of the events that cause an interface to be reinitiated are:
    

1. The interface is Disabled, and then Enabled.
   
2. The Repair feature is used.
   
3. The commands ipconfig /release and ipconfig /renew are given.
   
4. The computer awakes from a suspend or hibernation state.
   
5. You removed and replugged a network cable or moved a computer out of and back into wireless range.
   
6. ARP cache entries can be deleted manually by using the arp command with the -d option.
   
   
   Example: arp -d 192.168.0.1
   Removes ARP mappings for 192.168.0.1 on all interfaces.