(Sound like a seal?)

The Address Resolution Protocol (ARP) is used by the Internet Protocol (IP), specifically to map IP network addresses to the hardware addresses. Each Network Interface Card (NIC)/adapter has a unique Media Access Control (MAC) address. The MAC address is one way a computer can be identified.

It is easy enough to get the MAC address for a local machine by entering the command ipconfig /all in a console window. This command shows detailed information for each adapter installed on a computer. The MAC address of an adapter is identified as the Physical Address. Easy enough, but how do you get this information for a remote machine?



Included with Windows® is a program by the name of arp.exe. Without getting too involved, keeping it simple, and assuming a basic understanding of networking, ARP.exe (console window) is used to display and modify the IP-to-Physical address translation tables. This command has a number of parameters, in particular the –a parameter displays the current resolution table entries. Basically, when you type arp –a each machine that an adapter ‘communicated’ with is listed in this table. Both the IP address and Physical Address are listed for each.




If there is an adapter that you are capable of connecting to and you do not see it the resolution table, initiate some ‘communication’ with it and check the resolution table again (arp – a). Generally, I PING (Packet INternet Groper) the machines/adapters I want to get the information of before I look at the table.

If you haven’t done so yet take a look at AddrMon.

Labels: How-To, Information, Tech