Inspecting ARP Cache Tables

An IPv4 address like 192.168.1.20 is a logical concept created by operating system software. Copper Ethernet cables and physical switch circuits do not understand IP addresses; they move raw bits based on 48-bit MAC addresses burned into network interface cards.

Whenever an application wants to send data to another computer on the same local subnet, the operating system checks its local memory cache called the ARP Table. If a record matching the target IP address already exists, the computer immediately stamps the destination MAC onto the Ethernet frame header and transmits.

However, if no matching record exists in memory, normal packet transmission pauses. The network card must first send an ARP inquiry across the wire to discover who owns that IP address.

Broadcasting an inquiry for every single data packet would quickly overwhelm the local switch with broadcast chatter.

To prevent network slowdowns, operating systems cache resolved IP-to-MAC pairs in fast RAM.

Once an address is cached, thousands of future web packets, file transfers, and database requests travel directly to the destination switch port using unicast delivery.

Without this caching mechanism, every single keystroke in an SSH session or frame in a video stream would trigger a network-wide broadcast, severely crippling switch capacity.

Open the console on Host A and check its initial cache by typing arp -a. If the computer just booted and has not communicated yet, the table will be empty.

Now initiate a ping to Host B at 192.168.1.20. Because Host A does not yet know Host B physical address, it generates an ARP Request frame.

Because the destination MAC is set to the universal broadcast address FF:FF:FF:FF:FF:FF, the switch floods the frame out of all ports so every device on the segment hears the question.

Breaking Down the ARP Request Fields:

When Host B receives this broadcast, it notices that Target IP matches its own address. Host B updates its own cache with Host A address, then sends back a unicast ARP Reply (Opcode 2) containing its real MAC: 0050.7966.2001.

Notice that while the request was broadcast to all ports, the reply is unicast directly back to Host A because Host B already knows Host A MAC from the request.

Now that the ping sequence has completed successfully, re-run arp -a on Host A to inspect the updated contents of its memory cache.

Notice that the table now contains an active mapping pairing IP address 192.168.1.20 with Host B physical MAC address.

Operating systems assign an expiration timer to this mapping so that stale entries are cleanly refreshed if network interface cards are replaced.

Field-by-Field Table Analysis:

From this moment forward, whenever an application on Host A sends data to 192.168.1.20, the network stack checks this table and immediately addresses the Ethernet frame directly to 0050.7966.2001 without generating any broadcast traffic.

A workstation ARP table expands naturally as it communicates with different machines across the local office network.

To observe table growth, send an ICMP echo test from Host A to the Office File Server at 192.168.1.100, then inspect the table again.

Tracking Cache Expansion:

Host A now stores two distinct dynamic entries in memory.

Notice that the first ping packet to 192.168.1.100 completed in 1ms because the switch learned both ports during the ARP resolution.

The operating system organizes these entries in a fast hash table data structure. Even if an office network contains hundreds of computers, lookup times remain nearly instantaneous.

Local vs Remote Address Resolution: If Host A needs to reach an external website like 8.8.8.8, it will never broadcast an ARP request for 8.8.8.8. Because 8.8.8.8 is outside the local subnet, Host A checks its routing table, identifies its default gateway (e.g. 192.168.1.1), and issues an ARP request for the router MAC address instead.

Dynamic ARP entries do not remain in memory forever. Operating systems enforce an aging timer (typically 2 to 20 minutes of inactivity) to purge old entries.

Aging prevents communication failures if a device receives a new network card or changes IP addresses.

To simulate the aging process and observe an empty cache, execute the command arp -d * in the terminal.

Verifying Cache Purging:

The arp -d * command flushes all dynamic entries from RAM.

When you run arp -a, the terminal confirms that the table is completely empty.

If Host A sends a ping now, it will once again broadcast an ARP Request frame across the switch, rebuilding its table dynamically.

In enterprise troubleshooting, flushing the ARP cache is a standard remedy whenever network hardware is replaced or IP conflicts are resolved.

Defending Against ARP Poisoning: Because standard ARP has no authentication, attackers can send falsified ARP replies (ARP spoofing) claiming to be the default gateway. Enterprise switches counter this using Dynamic ARP Inspection (DAI), which validates ARP packets against the DHCP snooping binding database before forwarding.