ARP is used to perform IP address resolution which is the linking of IP addresses to MAC (Media Access Control) hardware addresses. ARP uses a broadcast to do this by asking the host that has the given IP address to respond to the broadcast with its MAC address. This step is required to create the data packet at the data link layer of the OSI network model.
RFC 826 defines ARP. ICMP used for ARP reply, possibly Information Reply. Entries in ARP cache are kept for a maximum of 10 minutes according to Microsoft documentation. An entry that is not used within 2 minutes is deleted. On some systems, the 10 minute lifetime is renewed every time the entry is used. Windows NT deletes entries from its cache starting with the oldest, even if its lifetime is not expired, to make room for new entries as the ARP table capacity is reached.
|arp -a or arp -q||List the ARP cache|
|arp -s ipaddress macaddress||Add an arp entry|
|arp -d ipaddress||Remove an arp entry|
Redundant IP addresses can cause broadcast storms.