ARP Cache on Windows Host

[rmnv]

I'm trying to understand how the local arp cache table on a windows host is utilized. When looking for hosts on your local subnet if the entries are not currently in your arp cache, it will then issue an ARP broadcasts to all devices on that local subnet. But what I'm seeing is that even though this table contains hosts entries, it still performs ARP broadcast. Are there reasons why it would not look at my local cache before sending out an ARP?

[Richard Burts]

Are you sure that it is doing an ARP broadcast looking for an address that is currently in the cache? The timeout for ARP cache in Windows is pretty short. I wonder if Windows had flushed and entry and then had to go look for it again.

HTH

Rick

[rmnv · Accepted solution]

I think you might be right and that's what I'm researching now. I'm viewing my cache with the arp -a command and now I'm thinking that might not be valid. An article I read spoke about the cache file as being marked as "stale" and I think this happens from 15 seconds to 45 seconds. Still researching and will follow up as soon as I've acquired more info.