When running arp -a in a Windows Server 2008 R2 prompt, will the returned entries cover connections from all users logged on to the machine or only the current?
The arp cache is a table containing all the arp entries the machine knows about. It's not collected or segmented in a user-specific fashion.
Be aware, however, that dynamic arp entries expire fairly quickly, so your arp table might not even be a good representation of MAC addresses the computer has collected, just a good representation of the past couple of minutes' worth of network activity. (From the link above):
Dynamic ARP cache entries
These entries are added and deleted automatically during normal use of TCP/IP sessions with remote computers. Dynamic entries age and expire from the cache if not reused within 2 minutes.
answered Feb 10 '14 at 11:03
-
-
@dusan.bajic Could be. Could also be the rest of the text at that link -
If a dynamic entry is reused within 2 minutes, it may remain in the cache and age up to a maximum cache life of 10 minutes before being removed or requiring cache renewal by using the ARP broadcast process.Not something I really have much motivation to research, you know? – HopelessN00b Feb 10 '14 at 11:27
To the best of my knowledge, the ARP table is part of the TCP/IP stack, thus it's machine wide.
