where is the ARP file

[pranav2794]

I have read that the ARP cache is stored in the computer. Whenever the computer finds anything new relation of a MAC with any IP address, it makes a table in its memory and stores all this information so that next time it doesn't have to find the MAC for the IP.
I wanna know the location of this file in Windows and LInux.
How I can access these ?

[Goatboy]

it makes a table in its memory ... I wanna know the location of this file in Windows and LInux.

I think you just answered your own question. As far as I know, the ARP cache resides entirely in memory. The name escapes me right now, but there's a tool that reverse engineers use to log which files are being modified on a system (to track the activity of malware, for example). You could try running something like that and then modify your ARP table to see if it's written anywhere. Doubt it, though.

[Vulpine]

Code: Select all

arp -a

That may be what you're looking for. It displays the arp cache on Windows and Linux. Judging from your other posts though, I wouldn't waste any time looking for remote MAC addresses in there. Routers strip that info at every hop.

[pranav2794]

ya thank you i got the arp table from that arp command
is there any other command i can edit that arp table ?

[infiniti2]

Bumping an old thread, but by looking up arp /? it says that there are options to delete and add an entry.

ARP -d inet_addr eth_addr to delete an entry
ARP -s inet_addr eth_addr to add an entry

inet_addr is the ip address and eth_addr is the physical address.

Using this method you could delete an ip address and it's associated MAC address then add that id address again with whatever MAC address you desired (or vice versa). It's worth noting that you could probably use the wildcard operator (*) in order to delete an entry if you only know the IP address or the MAC address.

ARP -d 23.239.234.1 *
ARP -d * 00-00-00-00-00-00

I'm not sure if this is of practical use for what you need, but I hope it helps.