The Address Resolution Protocol (ARP) takes the 32-bit Internet Protocol (IP) address and finds the matching 48-bit physical (Ethernet) address. ARP queries machines on the local network for their physical address and keeps a cache of the most recently used IP – physical address pairs.

When utilising the Internet Protocol (IP) to communicate with a remote computer, the ARP cache is first consulted to see if the IP address is resident; if so the physical address is used to send the datagram directly to the appropriate computer. If the IP address is not in the cache ARP issues a broadcast. Every machine on the network checks the enclosed IP address and adds the IP address – physical address pair of the originating computer to its ARP cache. The matching computer generates an ARP reply that includes the physical address. The original computer will add this IP address – physical address pair to its ARP cache and send its datagram to this machine.

The physical address is programmed into the network card at manufacture. It is written as 6 hexadecimal pairs to improve legibility.

The arp command is used to view and edit the contents of the ARP cache. Entries in the cache are removed automatically after between 2 and 10 minutes if they are not used again in this time span.

Arp –a View all ARP cache entries

Arp –g View all ARP cache entries

Arp –a <IP address> shows entry associated with the input address.

Arp –s (IP address physical address> manually adds a permanent static entry to the cache, useful for the addresses of machines which will be accessed often. E.g. arp –s 192.59.66.250 00-80-C7-E0-7E-C5

Arp –d <IP address> permanently deletes a static entry.