How Windows 2000 Resolves IP to MAC Addresses

Microsoft Windows 2000 relies on the Address Resolution Protocol (ARP) to map 32-bit IPv4 addresses to physical Media Access Control (MAC) addresses on a local area network. When a Windows 2000 system needs to send data to another host on the same subnet, it utilizes ARP to discover the destination hardware address, maintaining an internal ARP cache to optimize network traffic and speed up subsequent communications.

The Role of ARP in Windows 2000

The TCP/IP protocol suite in Windows 2000 operates at the Network layer using IP addresses, while the underlying network hardware (such as Ethernet adapters) operates at the Data Link layer using 48-bit MAC addresses. Because network interface cards (NICs) cannot deliver frames using IP addresses alone, Windows 2000 implements ARP (defined by RFC 826) as the standard translation mechanism.

How the Resolution Process Works

When Windows 2000 prepares to transmit an IP packet to a local host, it executes the following steps:

  1. ARP Cache Lookup: The system first checks its local ARP cache table to determine if the destination IP address already has an associated MAC address. If a match is found, the data frame is immediately addressed and sent.
  2. ARP Request Broadcast: If the MAC address is not cached, the Windows 2000 TCP/IP stack generates an ARP Request packet. This packet contains the sender's IP and MAC addresses along with the target's IP address. It is transmitted as a broadcast frame (FF-FF-FF-FF-FF-FF) so every device on the local segment receives it.
  3. ARP Reply Unicast: Every host on the subnet inspects the broadcast. The host configured with the matching IP address records the sender's information in its own cache and transmits a unicast ARP Reply directly back to the Windows 2000 system, providing its hardware MAC address.
  4. Cache Update and Transmission: Windows 2000 receives the ARP Reply, records the target IP-to-MAC mapping in its ARP cache, and transmits the pending network payload.

If the destination IP address resides on a remote network, Windows 2000 does not resolve the remote host's MAC address directly. Instead, it uses ARP to resolve the MAC address of the configured default gateway (router), forwarding the packet there for routing.

The Windows 2000 ARP Cache

To minimize broadcast traffic, Windows 2000 stores resolved addresses in a temporary table. Cache entries fall into two categories:

  • Dynamic Entries: Created automatically through the resolution process. In Windows 2000, dynamic entries have an aging mechanism. If an entry is not reused within two minutes, it is removed. If it is actively used, the lifetime can extend up to ten minutes before expiring and requiring re-resolution.
  • Static Entries: Configured manually by an administrator. Static entries remain in the table indefinitely until the machine is rebooted or the entry is manually deleted.

Managing ARP in Windows 2000

Windows 2000 includes the command-line utility arp.exe to allow administrators to view and manipulate the ARP table:

  • arp -a: Displays the current ARP cache table, showing IP addresses, corresponding physical addresses, and entry types (static or dynamic).
  • arp -s <IP address> <MAC address>: Manually adds a permanent, static entry to the cache.
  • arp -d <IP address>: Deletes a specific entry from the table, or clears the entire cache when run without an IP address.