Dynamic and Static ARP cache record types

Dynamic and Static ARP cache record types
Dynamic and Static entries of ARP cache record types are used to minimize the broadcast volume. ARP maintains the IP address-to-MAC address ing cache for future use. According to the cache validity period, the ARP cache contains dynamic and static entries. This document selects a comprehensive manual for ARP.
This section describes how to distinguish Dynamic and Static entries in the ARP cache table. In Windows and Linux systems, ARP caches are marked in different ways.
1. view the flag method in Windows
[Instance 1-10] in Windows, view the dynamic and static entries in the ARP cache table. Run the following command:

C: \ Users \ Administrator> arp-

Interface: 192.168.5.4 --- 0xc

Internet address physical address type

192.168.5.1 c8-3a-35-84-78-1e Dynamics

192.168.5.255 ff-ff static

224.0.0.2 01-00-5e-00-00-02 static

224.0.0.22 01-00-5e-00-00-16 static

224.0.0.20.01-00-5e-00-00-fb static

224.0.0.252 01-00-5e-00-00-fc static

224.0.0.253 01-00-5e-00-00-fd static

239.00000000250 01-00-5e-7f-ff-fa static

Extends 00000000255 ff-ff static

The above output information shows the ARP cache entries for the 192.168.5.4 interface. The output results show that the entries saved in the ARP cache are a table corresponding to the IP address-MAC address. The "dynamic" of the type column indicates the entries dynamically obtained using ARP requests, and the "static" indicates the ARP table that is manually configured and maintained.

2. view the flag method in Linux

[Instance 1-11] in Linux, view static entries and dynamic entries in the ARP cache table. There are three ways to view the ARP cache table.

(1) Method 1: arp command

Run the arp command to view the ARP cache table in Linux. As follows:

Root @ kali :~ # Arp

Address HWtype HWaddress Flags Mask Iface

192.168.5.1 ether c8: 3a: 35: 84: 78: 1e C eth0

The output information shows the local ARP cache table. The cache table contains a dynamic ARP cache entry.

Use arp-s to bind this entry to a static ARP entry. Run the following command:

Root @ kali :~ # Arp-s 192.168.5.1 c8: 3a: 35: 84: 78: 1e

After the preceding command is executed, the ARP entry at 192.168.5.1 becomes static. In this case, you can use the arp command to view the ARP cache table again. As follows:

Root @ kali :~ # Arp

Address HWtype HWaddress Flags Mask Iface

192.168.5.1 ether c8: 3a: 35: 84: 78: 1e CM eth0

From the output information, we can see that in the ARP entry whose address is 192.168.5.1, Flags Mask is CM, indicating that the entry is static.

(2) Method 2: arp-a command

Run the arp-a command to view the ARP cache table in Linux. As follows:

Root @ kali :~ # Arp-

Router. router (192.168.5.1) at c8: 3a: 35: 84: 78: 1e [ether] on eth0

Use arp-s to bind this entry to a static ARP entry. Run the following command:

Root @ kali :~ # Arp-s 192.168.5.1 c8: 3a: 35: 84: 78: 1e

After the preceding command is executed, the ARP entry at 192.168.5.1 becomes static. In this case, run the arp-a command to view the ARP cache table again. As follows:

Root @ kali :~ # Arp-

Router. router (192.168.5.1) at c8: 3a: 35: 84: 78: 1e [ether] PERM on eth0

From the output information, we can see that the ARP entry is different from the output information before binding. Here, a PERM keyword is added to indicate that the entry is a static ARP cache entry.

(3) method 3: view files

Check the/proc/net/ARP file if no arp entry is bound. As follows:

Root @ kali :~ # Cat/proc/net/arp

IP address HW type Flags HW address Mask Device

192.168.5.1 0x1 0x0 c8: 3a: 35: 84: 78: 1e * eth0

The output information shows the local ARP cache table. The cache table contains a dynamic ARP cache entry.

Bind an ARP entry. Run the following command:

Root @ kali :~ # Arp-s 192.168.5.1 c8: 3a: 35: 84: 78: 1e

Run the preceding command to view the/proc/net/arp file again. Information to be displayed:

Root @ kali :~ # Cat/proc/net/arp

IP address HW type Flags HW address Mask Device

192.168.5.1 0x1 0x6 c8: 3a: 35: 84: 78: 1e * eth0

The output information shows that this entry is different from the previous one. The value of Flags in this entry is 0x6, which is 0x0 before binding. This article selects the Comprehensive Manual for ARP.