1

When running arp -a in a Windows Server 2008 R2 prompt, will the returned entries cover connections from all users logged on to the machine or only the current?

2 Answers 2

4

The arp cache is a table containing all the arp entries the machine knows about. It's not collected or segmented in a user-specific fashion.

Be aware, however, that dynamic arp entries expire fairly quickly, so your arp table might not even be a good representation of MAC addresses the computer has collected, just a good representation of the past couple of minutes' worth of network activity. (From the link above):

Dynamic ARP cache entries

These entries are added and deleted automatically during normal use of TCP/IP sessions with remote computers. Dynamic entries age and expire from the cache if not reused within 2 minutes.

2
  • AFAIR default expire time is 30+-15 seconds since Vista/2008 Feb 10, 2014 at 11:26
  • @dusan.bajic Could be. Could also be the rest of the text at that link - If a dynamic entry is reused within 2 minutes, it may remain in the cache and age up to a maximum cache life of 10 minutes before being removed or requiring cache renewal by using the ARP broadcast process. Not something I really have much motivation to research, you know? Feb 10, 2014 at 11:27
0

To the best of my knowledge, the ARP table is part of the TCP/IP stack, thus it's machine wide.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .