ARPCache

ARPCache refers to the memory-resident table that stores recently learned mappings between IP addresses and MAC addresses used by the local network stack to deliver packets on a link layer. It is part of the Address Resolution Protocol (ARP) mechanism, which resolves IPv4 addresses to hardware addresses on a local network segment.

How it works: When a host needs to send a packet to an IPv4 address on the same broadcast domain, it first checks the ARP cache. If a valid entry exists, the host uses the associated MAC address to frame the Ethernet (or other link-layer) packet. If the entry is missing or expired, the host sends an ARP request broadcast, and the replying device provides its MAC address, which is then stored in the ARP cache for future use.

Lifetime and maintenance: ARP cache entries are dynamic and typically have a limited lifetime, governed by per-entry timers. Entries may be invalidated when devices move, change IPs, or when the cache is cleared. Some systems also support static ARP entries configured by administrators to prevent dynamic updates.

Security considerations: ARP is unauthenticated, making ARP caches vulnerable to spoofing or poisoning attacks, where a malicious device associates its MAC address with another IP. Mitigation strategies include network monitoring, static entries for critical devices, and segmenting networks or using security features that limit ARP traffic.

Administration: Common tasks include viewing and modifying the cache. Windows users can use arp -a to display entries and arp -d to delete, while Linux systems use commands such as ip neigh or arp -n. Clearing or flushing the cache can resolve connectivity issues caused by stale entries.

See also: Neighbor Discovery Protocol (IPv6), ARP spoofing.