IP address-to-MAC address resolution for outgoing
packets is performed by ARP. As each outgoing IP datagram is encapsulated
into a frame, source and destination MAC addresses must be added. Determining
the destination MAC address for each frame is the responsibility of ARP.
ARP compares the destination IP address on every
outbound IP datagram to the ARP cache for the NIC that frame will be sent
over. If there is a matching entry, then the MAC address is retrieved from
the cache. If not, ARP broadcasts an ARP Request Packet onto the local
subnet, requesting that the owner of the IP address in question reply with
its MAC address. If the packet is going through a router, ARP resolves
the MAC address for that next-hop router rather than the final destination
host. When an ARP reply is received, the ARP cache is updated with the
new information, and it is used to address the packet at the link layer.
The address resolution protocol (ARP) cache is a list of recently resolved IP address to Media Access Control (MAC) address mappings.
Entries in the ARP cache may be viewed, added, or deleted using the ARP utility. Examples are shown below. Entries added manually are static, and do not get aged out of the cache like dynamic entries do.
To view the ARP cache:
C:\>arp -a
To add a static entry to the arp cache used by a
interface, for the host whose IP address is 10.57.10.32 and whose NIC address
is 00608C0E6C6A:
C:\>arp -s 10.57.10.32 00-60-8c-0e-6c-6a 10.57.8.190
Entries are aged out of the ARP cache if they are
not used by any outgoing datagrams for two minutes. Entries that are being
referenced get aged out of the ARP cache after 10 minutes. Entries added
manually are not aged out of the cache. Entries can be deleted from the
cache using arp -d as shown below:
C:\>arp -d 10.57.10.32
ARP will only queue one outbound IP datagram to a given destination address while that IP address is being resolved to a MAC address. If a UDP-based application sends multiple IP datagrams to a single destination address without any pauses between them, some of the datagrams may be dropped if there is no ARP cache entry already present.
If an entry in the ARP cache is incorrect, TCP/IP packets may be sent to the wrong computer.