Let's get started by looking at the Windows ARP cache.
To do this, we need to open a command prompt,
but not just a regular command prompt, an administrator level command prompt.
Several of the commands we'll be running will not work
at a Windows standard command prompt.
To open the administrator level command prompt,
I'm going to right-click on my command prompt shortcut,
right-click on the command prompt and select Run as administrator.
I'll select Yes to the user account warning.
In the Windows command prompt, I am going to start with the ARP -a command.
This command shows us the ARP cache for all the interfaces within our machine.
You can see in the first line that this ARP cache is for
the interface with the IP address 20.
1.
4.
There are three columns.
The internet address column shows us the IP addresses within the ARP cache.
The physical address column shows us the MAC addresses
associated with those particular IP addresses.
And the type column shows how that entry was generated,
either through dynamic ARP or through a static entry.
Let's take a look at the dynamic entries.
The first dynamic entry is actually the default-gateway for this computer.
It's the most common dynamic entry to see in your ARP cache as every computer
needs a way to communicate off of its local area network.
The next two dynamic entries, 20.
1.
7 and 20.
1.
9 are other systems within the LAN.
Notice that this machine's IP address and MAC address
are not shown in the ARP cache.
Now let's take a look at the static entries.
Notice the first and last static entries, 20.
1.
255, and the all networks broadcast, 255.
255.
255, both share the all Fs MAC broadcast address.
This is used whenever this computer wants to send a broadcast message either to
the local area network or to the all network's broadcast.
These static entries are generated by the operating system automatically.
The other three static entries beginning with 224 and 239 are
multicast addresses also statically programmed by the operating
system through its normal function.
Remember that the ARP cache is referenced when this system
needs to send data to a particular IP address,
these entries are utilized as a lookup for matching MAC addresses.
Don't forget that any data going off the local area network will use
the MAC associated with the default-gateway 20.
1.
Also, remember that if an entry does not exist in this table,
the system will need to generate an ARP request.
If no entry is found in the table or from an ARP request and reply,
the system will not be able to add appropriate MAC
addresses and cannot send the data.
Now I'd like to take a quick look at the ARP command options.
I'm going to clear the screen and I'm going to use the arp /?
switch called the help switch to look at the ARP
commands definition and its options.
You'll notice that the first part of the help file shows
the definition for the ARP command, then we see some use case examples,
then we see a section that defines how the switches are utilized.
The switches are essentially options that allow us to
change the way the ARP command functions.
The ARP -a is the one that displays our ARP cache and we just saw.
The -g is the same as the a.
The -v allows for verbose mode and outputs a bit more information.
The -n allows us to specify which interface we want to look at the ARP
cache for if we have more than one interface on the system.
The -d option allows us to delete entries from our ARP cache
while the -s allows us to add static entries.
And then at the bottom, we see some example commands.
It's always useful to look at the help file for a command so that
you understand more about how it functions.
Let's take a look at how we can use the ARP command along
with some tools to get the IP and MAC address bindings
for anything within our LAN.
I'm going to clear the screen again,
and now we're going to use the ping command along with our ARP command.
Again, let's take a look at our ARP cache with the -a.
Here I see three dynamic entries.
I know there are other systems in my LAN and I know their IP address.
I can ping those systems and I will be generating an ARP request and reply
in the background which will be filled into my ARP cache.
Let's ping a switch in my network, 20.
1.
100.
You'll notice the first one times out,
that's actually because ARP is doing its job in the background.
So now if I take a look at my ARP cache,
I should see that switch's IP address and its
associated MAC address in my table.
I can do that for other systems in my LAN.
I'll hit the up arrow and change the IP address to
another system IP address within my LAN.
Once I do that, the ARP cache should then hold its associated MAC address.
It is possible to cycle through pings for all the systems within our LAN,
however,
you may or may not know the IP addresses of all the live systems in
your LAN and you may have hundreds or thousands of computers making
this job impossible or very tedious.
So we're going to employ another tool, an IP address scanner.
Let me clear my screen and we'll bring up our IP address scanner.
A note of warning, as a reconnaissance and mapping tool,
an IP address scanner scans a range of IP addresses with
ICMP pings and ARP requests and may also generate
significant scans for network services.
For this reason, it can disrupt the network,
network systems, or even be viewed as a hack tool.
Therefore,
unless you're the administrator or have specific
administrator permission to use one,
use caution with this on your local area networks.
Let's see how I have my advanced IP scanner set to generate
the minimum amount of interference and do the job of just
gathering IP and MAC address bindings.
Within the Settings, in the Options,
I have sent my scan resources so that all options are unchecked.
Within the Performance section,
if my LAN is large or very busy and I wish to improve the
results and reduce the overhead on the network,
I will check High accuracy scanning and reduce the speed on the slider bar.
Within the address bar, I've set the local area network address 20.
1.
0/24.
When I click the Scan button,
the scanner starts scanning the range of IP addresses from 20.
1.
1 through 20.
1.
255.
You'll notice it's generated a list of live systems by name
if they can be resolved by IP address,
the manufacturer column shows the manufacturer of the network
card based on the first half of the MAC address,
and a list of MAC addresses.
This is essentially my ARP cache.
This means that all these entries should also appear
within my Windows system ARP cache.
Let's take a look.
With the ARP -a command,
the exact same results appear within my dynamic
entries within my Windows ARP cache.
Ping or an IP scanner along with the ARP cache is a great
way to get the IP address and MAC addresses of any live
systems within your network.
Now it's time to take a look at how and why you might add
a static entry into your ARP cache.
Static entries are not commonly used by administrators as the dynamic
ARP process functions well and has very low overhead.
Static entries can also create significant administrator overhead when
there are IP or MAC changes in the network and create confusion and extra
troubleshooting opportunities when misconfigured.
As dynamic ARP does generate broadcast on a network,
the static entry for common and stable systems in the network,
such as a server or a gateway, would reduce broadcasts.
However, when there are changes, as noted before,
it leads to a lot of work and possible misconfigurations.
Likewise, some cyber attack use cases we'll see later,
such as ARP cache poisoning, utilize ARP,
and static entries could reduce those threats.
However, there are often better methods to solve these problems than static ARP.
So unless your use case is clear,
static entries should generally be avoided and we
should let dynamic ARP do its job.
Reviewing the help for ARP shows us that the traditional command for
adding static entries into the Windows ARP cache is arp -s.
The syntax and the example show us that an IP address is next.
I'm going to use the address 20.
1.
75 currently not in use,
but I'll assume that this is a server that I'll be adding to the
network later and will always be at this IP address.
The next thing I need is the MAC address.
In this case, I'm going to put in a dummy MAC address of aa-bb-cc-dd-ee-ff.
As soon as I do that, you'll notice that I get an error.
This command has been deprecated and is only good in older versions of Windows.
In a current version of Windows,
even the administrator command prompt does not allow us to use it.
Since arp -s is no longer useful,
we're going to use a very powerful command called netsh.
The netsh command has a lot of variation.
In this case,
we're going to use it to view and alter the interfaces within Windows.
The first variation I'll show you is netsh interface ipv4 show interfaces.
This will output a list of the interfaces on our system.
I want you to pay particular attention to the idx or index number,
in this case,
we're going to concentrate on the 3 and the name of our interface Ethernet0.
To add a static entry,
I'm going to repeat my previous command and change
the show command to add a neighbor.
In this case,
I'm going to add a neighbor to my Ethernet0 interface with an IP address of 20.
1.
75 with the MAC address aa-bb-cc-dd-ee-ff.
This will add the static entry into my ARP cache which can
be verified with the arp -a command.
There, you can see the 20.
1.
75 IP address with the associated MAC address and its type is static.
Deleting entries from the ARP cache is as simple as repeating our
command and changing the add to the word delete.
Once I execute this command,
the appropriate entry has been deleted from the ARP
cache as verified by the arp -a.
Not only can you use the netsh command to delete ARP cache entries,
but you can also use the ARP command with the -d option.
In this case, we'll select an IP address 20.
1.
8 to remove from the ARP cache.
Arp -a shows that entry is now deleted.
Another more powerful version of the delete switch would add on
an asterisk to delete all possible entries.
In this case,
the ARP cache is required to be rebuilt by Windows
and by the dynamic ARP process.
Deleting items from your ARP cache can be useful if you have stale dynamic
entries or you have static entries which are incorrect.
In general though,
since the default ARP process is in our computer and the dynamic
ARP process are so robust and lightweight,
we generally don't need to add or remove entries
from our ARP cache within Windows.
The last topic to look at in our demonstration will be
changing the Windows cache timer.
And again, we'll use the netsh command to show our interfaces.
From here, we'll look at the specific details on interface3 ethernet0,
I'm going to change my show interfaces command to show interface 3.
What we see here is the output for the details on our ethernet0.
What I want you to concentrate on is the reachable
time and the base reachable time.
The ARP cache timer is the reachable time.
Currently, it's set to 21, 500 ms, that equates to 21.
5 seconds.
Although this is the ARP cache timer, we cannot change this directly in Windows.
Windows calculates the ARP cache reachable time as a factor of one half to 1.
5 times the base reachable time.
Since we can affect the base reachable time,
we can increase our ARP cache timer, the reachable time,
or decrease it by changing that base reachable time.
Again,
the command used to change the base reachable time is
the netsh interface ipv4 command.
In this case, however, we're going to set a change to our interface 3.
The change that we want to make or set to our
interface 3 is the base reachable time, and to set that,
we're going to say basereachable= and we're going to
give a number of milliseconds.
In this case, I'll increase it to double or 60, 000 ms.
When I check my interface 3, the base reachable time has increased to 60,
000 ms or 60 seconds and my reachable time is a factor of one half to 1.
5 times, it just so happens that it made it equal to it.
I can go ahead and increase this further by increasing my base reachable time.
Although it's rare to change your ARP cache timers within Windows,
you might find it useful on systems such as a server to extend the ARP
cache entries which would effectively reduce ARP on the network and
reduce overhead for busy systems like servers.
I'm going to go ahead and set my ARP cache timer back to its default of 30, 000.
Again, this is not setting the ARP cache timer directly,
but setting the base reachable time.
Notice that the reachable time or ARP cache timer is
again a factor of one half to 1. 5 times the base reachable time.