where is the ARP file

Data that travels over the air and how to protect (or decipher) it

where is the ARP file

Post by pranav2794 on Thu May 19, 2011 7:49 am
([msg=57553]see where is the ARP file[/msg])

I have read that the ARP cache is stored in the computer. Whenever the computer finds anything new relation of a MAC with any IP address, it makes a table in its memory and stores all this information so that next time it doesn't have to find the MAC for the IP.
I wanna know the location of this file in Windows and LInux.
How I can access these ?
pranav2794
New User
New User
 
Posts: 28
Joined: Mon May 09, 2011 3:14 pm
Blog: View Blog (0)


Re: where is the ARP file

Post by Goatboy on Thu May 19, 2011 3:07 pm
([msg=57567]see Re: where is the ARP file[/msg])

pranav2794 wrote:it makes a table in its memory ... I wanna know the location of this file in Windows and LInux.

I think you just answered your own question. As far as I know, the ARP cache resides entirely in memory. The name escapes me right now, but there's a tool that reverse engineers use to log which files are being modified on a system (to track the activity of malware, for example). You could try running something like that and then modify your ARP table to see if it's written anywhere. Doubt it, though.
Assume that everything I say is or could be a lie.
1UHQ15HqBRZFykqx7mKHpYroxanLjJcUk
User avatar
Goatboy
Expert
Expert
 
Posts: 2818
Joined: Mon Jul 07, 2008 9:35 pm
Blog: View Blog (0)


Re: where is the ARP file

Post by Vulpine on Thu May 19, 2011 5:44 pm
([msg=57575]see Re: where is the ARP file[/msg])

Code: Select all
arp -a


That may be what you're looking for. It displays the arp cache on Windows and Linux. Judging from your other posts though, I wouldn't waste any time looking for remote MAC addresses in there. Routers strip that info at every hop.
User avatar
Vulpine
Poster
Poster
 
Posts: 379
Joined: Fri Mar 26, 2010 11:14 pm
Blog: View Blog (0)


Re: where is the ARP file

Post by pranav2794 on Wed Jun 01, 2011 4:08 pm
([msg=57996]see Re: where is the ARP file[/msg])

ya thank you i got the arp table from that arp command
is there any other command i can edit that arp table ?
pranav2794
New User
New User
 
Posts: 28
Joined: Mon May 09, 2011 3:14 pm
Blog: View Blog (0)


Re: where is the ARP file

Post by infiniti2 on Sat Jun 18, 2011 2:25 am
([msg=58679]see Re: where is the ARP file[/msg])

Bumping an old thread, but by looking up arp /? it says that there are options to delete and add an entry.

ARP -d inet_addr eth_addr to delete an entry
ARP -s inet_addr eth_addr to add an entry

inet_addr is the ip address and eth_addr is the physical address.

Using this method you could delete an ip address and it's associated MAC address then add that id address again with whatever MAC address you desired (or vice versa). It's worth noting that you could probably use the wildcard operator (*) in order to delete an entry if you only know the IP address or the MAC address.

ARP -d 23.239.234.1 *
ARP -d * 00-00-00-00-00-00

I'm not sure if this is of practical use for what you need, but I hope it helps.
infiniti2
New User
New User
 
Posts: 1
Joined: Sat Sep 18, 2010 6:14 pm
Blog: View Blog (0)



Return to Networking

Who is online

Users browsing this forum: No registered users and 0 guests