Where is the ARP cache stored

ARP - address resolution for TCP / IP

From the IP address to the hardware and back

In a network based on TCP / IP, the physical addresses (MAC addresses) of the Ethernet cards are required to send the data packets. These addresses are queried using the ARP protocol in a broadcast process and successively "learned" or updated.

A MAC address is always assigned to a TCP / IP address via a broadcast process to all computers, but in order to keep the broadcast in the network within an acceptable range, ARP has a local cache of regular - kept on the client used network addresses.

Configuration service: RARP
The Reverse Address Resolution Protocol is the oldest configuration service of TCP / IP, it is only rarely used and mostly only for UNIX systems. RARP is used by clients who do not know their own IP address, the client sends a RARP broadcast into the network. This package contains the MAC address of the requesting client, which is available in the hardware of the Ethernet adapter (NIC) and is unique worldwide. The RARP server replies to the request with a valid IP address if it finds the following information:

  • MAC address and host name in the UNIX configuration file / etc / ethers
  • Host name and IP address in the UNIX configuration file / etc / hosts

RARP only returns the IP address, the other information (sub-network mask, standard gateway, DNS) must be configured manually. ARP and RARP are protocols of the «network access layer» in the OSI reference model, layer 2.

Further services for the administration and allocation of the TCP / IP configurations are DHCP and BOOTP, DHCP and BOOTP are the configuration services for TCP / IP currently in use.

ARP in practice
The ARP protocol is used unnoticed in the background for network communication with TCP / IP. In the OSI reference model, it covers the next layer (2) below IP.

Many users of TCP / IP network computers are not even aware of the existence of ARP (this is usually not necessary). The following practical example from the Windows environment shows the use of ARP. The used TCP / IP configuration of the computer:

Host name. . . . . . . . . : sni10.idvts.unizh.ch
DNS server. . . . . . . . . :,,,

Ethernet adapter DC21X41:
Description. . . . . . . . : DEC DC21143 PCI Fast Ethernet Adapter
Physical address. . . . . : 00-48-54-02-76-44
DHCP activated. . . . . . . : Yes
IP address. . . . . . . . . :
Subnet mask. . . . . . . . :
Standard gateway. . . . . . :
DHCP server. . . . . . . . :
Lease received. . . . . . . : Monday, November 1st, 2020 6:20:05 pm
Lease expires. . . . . . . : Monday, November 1st, 2020 8:20:05 pm
First, the current ARP cache is displayed with the arp -a command:

Z: \ lenzs> arp -a

Interface: on Interface 2
Internet address Physical address type 00-48-54-00-e3-d0 dynamic 00-80-5f-3a-97-4a dynamic

The saved TCP / IP and MAC addresses contain the address, which corresponds to the network's DHCP server. The TCP / IP standard gateway ( has not yet been entered in the memory or cache, as no connections outside of the local network have yet been called.

The next step is to use the PING command to check the connection to the host with the DNS entry www.stefan-lenz.ch.

Z: \ lenzs> ping www.stefan-lenz.ch

PING is carried out for www.stefan-lenz.ch [] with 32 bytes of data:
Reply from bytes = 32 time = 40ms TTL = 113
Reply from bytes = 32 time = 40ms TTL = 113
Reply from bytes = 32 time = 60ms TTL = 113
Reply from bytes = 32 time = 40ms TTL = 113

As expected, the server replies from the displayed IP address with 4 data packets (lossless). The effects of this PING command in the ARP cache are again checked with the arp -a command.

Z: \ lenzs> arp -a

Interface: on Interface 2
Internet address Physical address type 00-00-0c-01-52-79 dynamic 00-48-54-00-e3-d0 dynamic 00-80-5f-3a-97-4a dynamic

The IP address, which corresponds to the TCP / IP standard gateway or, in this case, the Internet router, has been added to the ARP cache. This expansion of the ARP cache takes place because the operating system has recognized and “learned” this new network participant based on the PING command.