checking ARP cache

[wagnj1]

**Using windows xp in cmd.exe

I've been learning about ARP caching a bit lately and wanted to check out what the ARP cache on my computer looks like. I ICMP pinged another device on the network and then tried "arp -a" to take a look at the ARP cache. However, it just keeps showing my gateway IP and MAC. I'm not incredibly knowledgeable on this topic, but I figure that maybe the ARP cache is stored on the gateway in my situation?? anyone have any ideas?

 

[raztaboule]

yes, your computer only stores arp for computers on your subnet , for other subnets the gateway will store the arp entry.

bye.

 

[wagnj1]

thanks for the ifno.
do you know if there's any way (or any program) to view ALL incoming packets in windows xp?? In linux I know there's a promiscuous mode that lets you view all incoming packets, but does windows xp have an equivalent?

 

[rwullems]

Windows XP itself not, but there are some free analyzers,

Ethereal;

http://www.ethereal.com/

Packetyzer (Ethereal with a nicer gui);

http://www.networkchemistry.com/products/packetyzer/

These will show you all icomming pakcet.s They will NOT show you the MAC address of the system you want to ping outside your subnet. In the pakcets you will find (again) the MAC adress of your gateway.
Regards,
Robert

Robert Wullems
Network Specialist
SCP/SCE/SCM/CNX/MCP/MCSA/Network+/CNA
***************************************
If you can Sniff it, you can solve it!
***************************************