Computer Networks/Arp/Modify

Arp is a Windows command used to view and modify the Address Resolution Protocol (ARP) cache. These activities will show you how to modify the ARP cache.

Note: To complete this activity, you must have an administrative user account or know the username and password of an administrator account you can enter when prompted.

Preparation

To prepare for this activity:

1. Start Windows.
2. Log in if necessary.

Activity 1 - Clear the ARP Cache

In order to limit the amount of information displayed, start by clearing the ARP cache:

1. Open an elevated/administrator command prompt.
2. Type arp -d and press Enter.

Activity 2 - View the ARP Cache

To view the ARP cache:

1. Type arp -a and press Enter.
2. Observe the ARP cache entries. There should not be any entries in the list. If there are, either a network host has contacted your computer, or a background process on your computer has contacted a network host or router since the cache was cleared.

Activity 3 - Ping the Default Gateway

To dynamically add an entry to the ARP cache, ping the default gateway:

1. Use ipconfig to display the default gateway address. Note the Default Gateway displayed.
2. Use ping <default gateway address> to ping the default gateway address.
3. Observe the results. You should see replies indicating success.

Activity 4 - View the ARP Cache

To view the ARP cache:

1. Type arp -a and press Enter.
2. Observe the ARP cache entries. There should be an entry for the default gateway showing its Internet (IP) address and physical (MAC) address. There may be other entries, depending on what other network hosts have contacted your computer, or what background process on your computer has contacted a network host.

Activity 5 - Modify the ARP Cache

Note: You will lose Internet access with this next step and will restore it again in Activity 8.

Method 1 - Windows XP and Earlier

Modify the ARP cache entry for the default gateway by replacing it with an invalid MAC static address:

1. Type arp -s <default gateway address> 00-11-22-33-44-55 and press Enter.

Method 2 - Windows 7 and Later

Determine your network adapter interface name and modify the ARP cache entry for the default gateway by replacing it with an invalid MAC static address:

1. Type netsh interface ipv4 show config.
2. Locate the interface with the default gateway listed in Activity 3. The interface name is typically "Local Area Connection" or "Wireless Network Connection".
3. Type netsh interface ipv4 add neighbors "<interface name>" <default gateway address> 00-11-22-33-44-55, where <interface name> is the name of the interface identified and <default gateway address> is the address of the default gateway listed in Activity 3. For example, if the interface name is "Local Area Connection" and the default gateway is 192.168.1.1, you would type netsh interface ipv4 add neighbors "Local Area Connection" 192.168.1.1 00-11-22-33-44-55.

Activity 6 - View the ARP Cache

To view the ARP cache:

1. Type arp -a and press Enter.
2. Observe the ARP cache entries. Notice that the default gateway now has the type static and has an invalid MAC address.

Activity 7 - Ping the Default Gateway

To test the ARP cache entry, attempt to ping the default gateway:

1. Use ping <default gateway address> to ping the default gateway address.
2. Observe the results. You should see "Request timed out.", indicating the default gateway cannot be reached.

Activity 8 - Reset the ARP Cache

Method 1 - Windows XP and Earlier

To reset the ARP cache:

1. Type arp -d and press Enter.
2. Type arp -a and press Enter to confirm that the static entry has been cleared.

Method 2 - Windows 7 and Later

To reset the ARP cache:

1. Type netsh interface ipv4 delete neighbors and press Enter.
2. Type netsh interface ipv4 show neighbors and press Enter to confirm that the static entry has been cleared.

Activity 9 - Ping the Default Gateway

Ping the default gateway to verify network connectivity to the default gateway:

1. Use ping <default gateway address> to ping the default gateway address.
2. Observe the results. You should see replies indicating success.

Activity 10 - View the ARP Cache

To view the ARP cache:

1. Type arp -a and press Enter.
2. Observe the ARP cache entries. Notice that the default gateway now has the type dynamic and its valid MAC address.
3. Close the command prompt to complete this activity.

Readings

• Wikipedia: Address Resolution Protocol (ARP)
• Wikipedia: IP Address
• Wikipedia: Media Access Control (MAC) Address
• Wikipedia: netsh

References

• Microsoft TechNet: Arp
• Microsoft TechNet: Netsh