The Windows ARP Table

The Windows ARP Table

The ARP table in Windows is a list of TCP/IP addresses and their associated physical (MAC) addresses. This table is cached in memory so that Windows doesn’t have to perform ARP lookups for frequently accessed TCP/IP addresses (for example, servers and default gateways). Each entry contains not only an IP address and a MAC address, but a value for Time to Live (TTL), which indicates how long each entry stays in the ARP table.

         The ARP table contains two kinds of entries:

• Dynamic
• Static

Dynamic ARP table entries

are created whenever the Windows TCP/IP stack performs an

ARP lookup and the MAC address is not found in the ARP table. The ARP request is broadcast on the local segment. When the MAC address of the requested IP address is found, that information

is added to the ARP table as a dynamic entry.

Note: 

The ARP table is cleared of dynamic entries whose TTL has expired to ensure that the entries are current.The ARP table is cleared of dynamic entries whose TTL has expired to ensure that the entries are current.