Understanding the Arp addresses

[Clyde2]

Hi,

  I have finished a college course in Networking but we did not cover the entire textbook so I am trying to finish it myself.  I have gotten to a chapter where you can input Command Prompt options for various troubleshooting scenarios.

  I am currently trying to understand the Arp (Address Resolution Protocol) commands.  I have been pulling up the arp cache using the arp -a command. 

  My cache shows only one dynamic entry (the one with my computers' IP address) and five other static addresses.

  I do not know what these IP addresses belong to or how to find out.  Furthermore, why are they static?

  I cannot ping the static addresses as the textbook asks me to do.  It does not say anything about static or dynamic.  Unfortunately the textbook does not get very specific in its explanations and usually leaves me hanging.

  My questions are:  Why are these addresses static for my home computer connection?     Is static safer than dynamic as far as security issues?     Why can't I Ping the static addresses?     What exactly is a dynamic address?     Is it supposed to change every time I connect to the Internet because of DHCP?     If so, why then is my dynamic IP home computer's address always the same?   

  I have tried to read some of the other Forum answers out there concerning pinging.  They say turn off your firewall for instance.  I just have the Windows Firewall that came with Vista Home Edition and I did turn it off to try a ping.  The ping on the static address still did not work.

  If anyone can help me understand this a little more, I would be appreciative.  Thank you in advance.

  Incidentally,  I used to do a Spell Check and Preview but I will do so no longer until I get assurance from Computer Hope.com that my entire message will not disappear into thin air.  This is what happened the last time I did a preview and lost my entire message.  Please you will have to put up with any potential bad spelling and poor sentence structure.

[dahlarbear]

1.  ARP Tutorial.  See Basic ARP, ARP Spoofing, and ARP - Address Resolution Protocol.

2.  Static Entry.  A static entry eliminates the need and time spent interrogating the local area network for MAC address corresponding to given IP address.  I believe static entries stay in the ARP cache until the system is rebooted.  My guess is they are being added to the cache via a "log on" script.  Disadvantage to static entry is the time "wasted" troubleshooting when IP address of node it refers to is changed and you're not notified.  I'm surprised you have "any" static entries in your ARP cache.  I guess it depends upon the network environment you're operating in.

I think a "static" arp entry would only be added for nodes that have a "static" IP address.  If the node used dynamic IP addressing, the mapping in the arp table would be invalid as soon as the IP address changed.

I would not expect your host computer's IP address to be in the "arp cache"; certainly not as a dynamic entry.  (Although you did show it as computers', so perhaps it is the address of another node on your local area network.)

I'm not prepared to address the "security" issue.

3.  Dynamic Entry.  There's a default time to live for the dynamic entries.  I don't know what it is or where it is configured.  Point being, it's long enough to allow communication with another host or hosts without having to reestablish the mapping for each message; and short enough to remove entries from the arp table for hosts you haven't contacted in awhile.  The later is to keep the arp cache to a manageable size and reduce invalid mappings for hosts whose dynamic IP address changed.

[Clyde2]

  Thanks for the reply and info.

  That helps me to understand a little more.

  You said you are surprised to see static entries in my arp table.  OK.  I asked some friends to check their arp table for me on their computer and indeed they told me they only had dynamic entries.  One friend said he had only one dynamic entry and the other said he had only dynamic entrie(s).

  So, yes, good question, why are they there?  What do they represent?
 
  So.....what would happen if I delete those static entries?  Of course I would write down the IP and MAC  addresses first in case I need to add them back to the cache.  Is there a way to find out if those static addresses are vital to my computer or just maybe they are some sort of adware or something?

  Do you think they would automatically come back as you speculated they might be held in some log or something?    Would it be possible to check for such a log?     Is it wise to delete them?     I presume I can use the arp -d and arp -s commands to delete and add.

  I will try and get to the websites you provided as soon as time allows.  Thank you for helping me to learn.