When running arp -a in a Windows Server 2008 R2 prompt, will the returned entries cover connections from all users logged on to the machine or only the current?


The arp cache is a table containing all the arp entries the machine knows about. It's not collected or segmented in a user-specific fashion.

Be aware, however, that dynamic arp entries expire fairly quickly, so your arp table might not even be a good representation of MAC addresses the computer has collected, just a good representation of the past couple of minutes' worth of network activity. (From the link above):

Dynamic ARP cache entries

These entries are added and deleted automatically during normal use of TCP/IP sessions with remote computers. Dynamic entries age and expire from the cache if not reused within 2 minutes.

  • AFAIR default expire time is 30+-15 seconds since Vista/2008 – Dusan Bajic Feb 10 '14 at 11:26
  • @dusan.bajic Could be. Could also be the rest of the text at that link - If a dynamic entry is reused within 2 minutes, it may remain in the cache and age up to a maximum cache life of 10 minutes before being removed or requiring cache renewal by using the ARP broadcast process. Not something I really have much motivation to research, you know? – HopelessN00b Feb 10 '14 at 11:27

To the best of my knowledge, the ARP table is part of the TCP/IP stack, thus it's machine wide.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.