View ARP in the command prompt

arp -a to view the cached table.

Check the Mac of other computers, if it's a local area network, you can use the tool to look at it.

Categories: Computer Network >> Operating System Failures.

Problem description: What are the common parameters of the arp command?

Analysis: rp

Displays and modifies items in the Address Resolution Protocol (ARP) cache. The ARP cache contains one or more tables that store IP addresses and their resolved Ethernet or Token Ring physical addresses. Each Ethernet or Token Ring network adapter installed on a computer has its own separate table.

If used without parameters, the arp command displays help information.

Syntax arp[-a [iaddr] [n ifaceaddr]] g [iaddr] [n ifaceaddr]] d iaddr [ifaceaddr]] s iaddr etheraddr [ifaceaddr]].

Argument -a[ iaddr] [n ifaceaddr].

Displays the current ARP cache table for all interfaces. To display ARP cache entries for a specific IP address, use ARP -A with an IADDR parameter, where IADDR stands for IP address. If IADDR is not specified, the first applicable interface is used.

To display the ARP cache table for a specific interface, use the -n ifaceaddr parameter with the -a parameter, where ifaceaddr represents the IP address assigned to that interface. The -n parameter is case-sensitive.

g[ iaddr] [n ifaceaddr]

Same as -a.

d iaddr [ifaceaddr]

Delete the specified IP address entry, where IADDR stands for IP address. For a specified interface, to delete an item in the table, use the ifaceaddr parameter, where ifaceaddr represents the IP address assigned to the interface. To delete all items, use an asterisk (*wildcard instead of iaddr.)

s iaddr etheraddr [ifaceaddr]

Add a static entry to the ARP cache that resolves the IP address IADR to the physical address EtherADDR. To add a static ARP cache entry to a table for a specified interface, use the ifaceaddr parameter, where ifaceaddr represents the IP address assigned to the interface.

Show help at the command prompt.

Note The IP addresses of IADDR and IFACEADDR are represented by dotted decimal notation.

The physical address of EtherAddr consists of six bytes that are represented by hexadecimal notation and separated by hyphens (e.g., 00-aa-00-4f-2a-9c).

The IP of the local computer is, and there are two MAC caches on this interface; One is, the other is; The corresponding physical addresses are: 00-27-19-58-61-24 and 00-e0-4c-a0-2a-a7; It also explains that the two address types are dynamic addresses.

arp -a command:

To display ARP cached entries for a specific IP address, use ARP -A with the InetAddr parameter, where InetAddr stands for the IP address. If inetaddr is not specified, the first applicable interface is used.

To display the ARP cache table for a specific interface, use the -n ifaceaddr parameter with the -a parameter, where ifaceaddr represents the IP address assigned to that interface. The -n parameter is case-sensitive.

ARP cache tables can be viewed, added, and modified. In the command prompt, enter "arp -a" to view the contents of the arp cache table, as shown in the attached figure.

arp -a

You can use the "arp -d" command to delete all the contents of the arp table;

You can run arp -d + space + "Specify IP address" to delete the content of the row where the specified IP address is located.

Use "arp -s" to manually specify the correspondence between the IP address and the MAC address in the arp table, the type is static, this item is stored in the hard disk, not the cache table, it still exists after the computer is restarted, and it follows the principle that static is better than dynamic, so this setting is not correct, it may lead to the inability to access the Internet.

Press "Win" + at the same time"r"key, a pop-up box will pop up, output cmd, and we can open the terminal.

How to view the ARP cache table of the machine.

2In the first line, enter "arp", arp is an address resolution protocol, mainly to parse IP addresses into MAC addresses, which is commonly known as MAC addresses, we can see that all commands about ARP will be displayed, find the command arp -a, look at the red box in the figure.

How to view the ARP cache table of the machine.

3 Enter arp -a, then a string of arp tables will appear, find the one we need!

The arp -a command is used to view the local arp table on the computer.

The MAC address of the ARP table, the source hall is the physical address of the network card, that is, ten machines can be connected to the route, not necessarily to each other, because it may not be in a working group, and the network will be displayed as long as the data is routed.

The address resolution protocol is based on the mutual trust of each host in the network, and the host on the LAN can send ARP reply messages independently, and when other hosts receive the reply packet, it will not detect the authenticity of the packet and will record it to the local ARP cache.

Built-in targets in the arp table:

arp table accept, drop, queue, returnAccept means to accept the packet, dorp means to drop the packet, queue means to transfer the packet to user space, return means to return to the previous chain, and then execute the next rule of which rule the previous chain jumped to.

The arp table has a default target for each split chain, and when the packet is not matched by all the rules, it is sent to at least one built-in table (filter table) on the side of the default target, and -t is often used to specify the table to be manipulated. The filter table has two built-in chains, in and out, where in is used to process packets destined for the local machine, and out for packets sent by the local machine.