Computer Networks/Arp/Modify

Arp is a Windows command used to view and modify the Address Resolution Protocol (ARP) cache. These activities will show you how to modify the ARP cache.

Note: To complete this activity, you must have an administrative user account or know the username and password of an administrator account you can enter when prompted.

Preparation
To prepare for this activity:
 * 1) Start Windows.
 * 2) Log in if necessary.

Activity 1 - Clear the ARP Cache
In order to limit the amount of information displayed, start by clearing the ARP cache:
 * 1)  Open an elevated/administrator command prompt.
 * 2) Type arp -d and press Enter.

Activity 2 - View the ARP Cache
To view the ARP cache:
 * 1) Type arp -a and press Enter.
 * 2) Observe the ARP cache entries.  There should not be any entries in the list.  If there are, either a network host has contacted your computer, or a background process on your computer has contacted a network host or router since the cache was cleared.

Activity 3 - Ping the Default Gateway
To dynamically add an entry to the ARP cache, ping the default gateway:
 * 1) Use  ipconfig to display the default gateway address.  Note the Default Gateway displayed.
 * 2) Use  ping  to ping the default gateway address.
 * 3) Observe the results.  You should see replies indicating success.

Activity 4 - View the ARP Cache
To view the ARP cache:
 * 1) Type arp -a and press Enter.
 * 2) Observe the ARP cache entries.  There should be an entry for the default gateway showing its Internet (IP) address and physical (MAC) address.  There may be other entries, depending on what other network hosts have contacted your computer, or what background process on your computer has contacted a network host.

Activity 5 - Modify the ARP Cache
Note: You will lose Internet access with this next step and will restore it again in Activity 8.

Method 1 - Windows XP and Earlier
Modify the ARP cache entry for the default gateway by replacing it with an invalid MAC static address:
 * 1) Type arp -s 00-11-22-33-44-55 and press Enter.

Method 2 - Windows 7 and Later
Determine your network adapter interface name and modify the ARP cache entry for the default gateway by replacing it with an invalid MAC static address:
 * 1) Type netsh interface ipv4 show config.
 * 2) Locate the interface with the default gateway listed in Activity 3.  The interface name is typically "Local Area Connection" or "Wireless Network Connection".
 * 3) Type netsh interface ipv4 add neighbors " " 00-11-22-33-44-55, where is the name of the interface identified and is the address of the default gateway listed in Activity 3.  For example, if the interface name is "Local Area Connection" and the default gateway is 192.168.1.1, you would type netsh interface ipv4 add neighbors "Local Area Connection" 192.168.1.1 00-11-22-33-44-55.

Activity 6 - View the ARP Cache
To view the ARP cache:
 * 1) Type arp -a and press Enter.
 * 2) Observe the ARP cache entries.  Notice that the default gateway now has the type static and has an invalid MAC address.

Activity 7 - Ping the Default Gateway
To test the ARP cache entry, attempt to ping the default gateway:
 * 1) Use  ping  to ping the default gateway address.
 * 2) Observe the results.  You should see "Request timed out.", indicating the default gateway cannot be reached.

Method 1 - Windows XP and Earlier
To reset the ARP cache:
 * 1) Type arp -d and press Enter.
 * 2) Type arp -a and press Enter to confirm that the static entry has been cleared.

Method 2 - Windows 7 and Later
To reset the ARP cache:
 * 1) Type netsh interface ipv4 delete neighbors and press Enter.
 * 2) Type netsh interface ipv4 show neighbors and press Enter to confirm that the static entry has been cleared.

Activity 9 - Ping the Default Gateway
Ping the default gateway to verify network connectivity to the default gateway:
 * 1) Use  ping  to ping the default gateway address.
 * 2) Observe the results.  You should see replies indicating success.

Activity 10 - View the ARP Cache
To view the ARP cache:
 * 1) Type arp -a and press Enter.
 * 2) Observe the ARP cache entries.  Notice that the default gateway now has the type dynamic and its valid MAC address.
 * 3) Close the command prompt to complete this activity.

Readings

 * Wikipedia: Address Resolution Protocol (ARP)
 * Wikipedia: IP Address
 * Wikipedia: Media Access Control (MAC) Address
 * Wikipedia: netsh