ARP            Address Resolution Protocol

    IP address-to-MAC address resolution for outgoing packets is performed by ARP. As each outgoing IP datagram is encapsulated into a frame, source and destination MAC addresses must be added. Determining the destination MAC address for each frame is the responsibility of ARP.
    ARP compares the destination IP address on every outbound IP datagram to the ARP cache for the NIC that frame will be sent over. If there is a matching entry, then the MAC address is retrieved from the cache. If not, ARP broadcasts an ARP Request Packet onto the local subnet, requesting that the owner of the IP address in question reply with its MAC address. If the packet is going through a router, ARP resolves the MAC address for that next-hop router rather than the final destination host. When an ARP reply is received, the ARP cache is updated with the new information, and it is used to address the packet at the link layer.

    The address resolution protocol (ARP) cache is a list of recently resolved IP address to Media Access Control (MAC) address mappings.

    Entries in the ARP cache may be viewed, added, or deleted using the ARP utility. Examples are shown below. Entries added manually are static, and do not get aged out of the cache like dynamic entries do.

    To view the ARP cache:
            C:\>arp -a

    To add a static entry to the arp cache used by a interface, for the host whose IP address is 10.57.10.32 and whose NIC address is 00608C0E6C6A:
            C:\>arp -s 10.57.10.32 00-60-8c-0e-6c-6a 10.57.8.190
 
    Entries are aged out of the ARP cache if they are not used by any outgoing datagrams for two minutes. Entries that are being referenced get aged out of the ARP cache after 10 minutes. Entries added manually are not aged out of the cache. Entries can be deleted from the cache using arp -d as shown below:
            C:\>arp -d 10.57.10.32

    ARP will only queue one outbound IP datagram to a given destination address while that IP address is being resolved to a MAC address. If a UDP-based application sends multiple IP datagrams to a single destination address without any pauses between them, some of the datagrams may be dropped if there is no ARP cache entry already present.

    If an entry in the ARP cache is incorrect, TCP/IP packets may be sent to the wrong computer.