- [Instructor] The ARP command
is a tremendous troubleshooting tool
for ARP issues as well as layer two troubleshooting.
ARP stands for address resolution protocol
and is responsible for doing the layer three IP mapping
to layer two Mac addressing
to view the ARP cache.
I issue the arp -a command.
Say for example, I have a Rogue DHCP server
on the network.
It's handed me an IP and default gateway.
That's a false path to the internet.
I can do an ipconfig /all
and take note of the DHCP server that handed me the IP.
Next I'll ping the IP of the server.
Ping 192.168.51.1
This will force my machine to do an ARP request
to the Rogue server.
I can now issue
the arp -a command
to determine what the Mac address associated
with that device is.
Then I could track down the Mac address
of this client in my switches and shut it down.
The Arp cache breaks
down the IP to Mac mappings per interface.
It will list them as either static
which are user or system created
or dynamic if they are learned from a neighbor.
If I have a specific IP address I'm looking for
I can issue the arp -a
and its IP address
192.168.51.1
If I have a cache entry that I want to remove
I can issue an arp -d
and the IP address,
192.168.51.1.
They're not frequently necessary.
The arp -s command will allow me to add a static IP
to Mac address entry.
The ARP command isn't used very frequently
but when it's necessary, it's indispensable.