ARP.EXE

  • File Path: C:\Windows\system32\ARP.EXE
  • Description: TCP/IP Arp Command

Hashes

Type Hash
MD5 4ACDF3F896F2E34FBBB4BBA816E89B3E
SHA1 EB1C8778D17B5393B857AD80733EE00CBEA300A1
SHA256 F0B2969246808AAA41DC74FE8138A542560564474DFBA79DA329B44A951CC574
SHA384 73C8A6213BE7CB4FAE5A27AF429FCB8E4D5D8380D312AD5C6F77B0F7D494E20A1567515FFE6E3201CAD8557CBF63544E
SHA512 048A621CA80F1336E702A75CE318A70B37BBAB0F2481C26C930293D2E4236992B219BE650E2A6F78DDF4F5AC2D195BE0E16CC9145EC9F28007FFE7BABBAC3AA2
SSDEEP 384:tqw4GqYQzOo+yDOpU6OoS2EMIOAqjOMuG767wjG256nWSSmW:tTlqX2pU6O21JAzvG2wjb56O
IMP 02E80B21355ED722444F540585E82D1D
PESHA1 DB3826110BC5E20D872F2175A1AAAA43C57DA401
PE256 A4A987CFC4A75F160C6B4377F8976A685754EA074B8FBF628DA9D29FA3D9AEDF

Runtime Data

Usage (stdout):


Displays and modifies the IP-to-Physical address translation tables used by
address resolution protocol (ARP).

ARP -s inet_addr eth_addr [if_addr]
ARP -d inet_addr [if_addr]
ARP -a [inet_addr] [-N if_addr] [-v]

  -a            Displays current ARP entries by interrogating the current
                protocol data.  If inet_addr is specified, the IP and Physical
                addresses for only the specified computer are displayed.  If
                more than one network interface uses ARP, entries for each ARP
                table are displayed.
  -g            Same as -a.
  -v            Displays current ARP entries in verbose mode.  All invalid 
                entries and entries on the loop-back interface will be shown.
  inet_addr     Specifies an internet address.
  -N if_addr    Displays the ARP entries for the network interface specified
                by if_addr.
  -d            Deletes the host specified by inet_addr. inet_addr may be 
                wildcarded with * to delete all hosts.
  -s            Adds the host and associates the Internet address inet_addr
                with the Physical address eth_addr.  The Physical address is
                given as 6 hexadecimal bytes separated by hyphens. The entry
                is permanent.
  eth_addr      Specifies a physical address.
  if_addr       If present, this specifies the Internet address of the
                interface whose address translation table should be modified.
                If not present, the first applicable interface will be used.
Example:
  > arp -s 157.55.85.212   00-aa-00-62-c6-09  .... Adds a static entry.
  > arp -a                                    .... Displays the arp table.

Loaded Modules:

Path
C:\Windows\system32\ARP.EXE
C:\Windows\system32\IPHLPAPI.DLL
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\System32\NSI.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\RPCRT4.dll
C:\Windows\system32\snmpapi.dll
C:\Windows\System32\WS2_32.dll

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: arp.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.17763.1 (WinBuild.160101.0800)
  • Product Version: 10.0.17763.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/72
  • VirusTotal Link: https://www.virustotal.com/gui/file/f0b2969246808aaa41dc74fe8138a542560564474dfba79da329b44a951cc574/detection/

Possible Misuse

The following table contains possible examples of ARP.EXE being misused. While ARP.EXE is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_multiple_suspicious_cli.yml - arp.exe DRL 1.0

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

arp

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Displays and modifies entries in the Address Resolution Protocol (ARP) cache. The ARP cache contains one or more tables that are used to store IP addresses and their resolved Ethernet or Token Ring physical addresses. There is a separate table for each Ethernet or Token Ring network adapter installed on your computer. Used without parameters, arp displays help information.

Syntax

arp [/a [<inetaddr>] [/n <ifaceaddr>]] [/g [<inetaddr>] [-n <ifaceaddr>]] [/d <inetaddr> [<ifaceaddr>]] [/s <inetaddr> <etheraddr> [<ifaceaddr>]]

Parameters

Parameter Description
[/a [<inetaddr>] [/n <ifaceaddr>] Displays current arp cache tables for all interfaces. The /n parameter is case-sensitive. To display the arp cache entry for a specific IP address, use arp /a with the inetaddr parameter, where inetaddr is an IP address. If inetaddr is not specified, the first applicable interface is used. To display the arp cache table for a specific interface, use the /n ifaceaddr parameter in conjunction with the /a parameter where inetaddr is the IP address assigned to the interface.
[/g [<inetaddr>] [/n <ifaceaddr>] Identical to /a.
[/d <inetaddr> [<ifaceaddr>] Deletes an entry with a specific IP address, where inetaddr is the IP address. To delete an entry in a table for a specific interface, use the ifaceaddr parameter where ifaceaddr is the IP address assigned to the interface. To delete all entries, use the asterisk (*) wildcard character in place of inetaddr.
[/s <inetaddr> <etheraddr> [<ifaceaddr>] Adds a static entry to the arp cache that resolves the IP address inetaddr to the physical address etheraddr. To add a static arp cache entry to the table for a specific interface, use the ifaceaddr parameter where ifaceaddr is an IP address assigned to the interface.
/? Displays help at the command prompt.

Remarks

  • The IP addresses for inetaddr and ifaceaddr are expressed in dotted decimal notation.

  • The physical address for etheraddr consists of six bytes expressed in hexadecimal notation and separated by hyphens (for example, 00-AA-00-4F-2A-9C).

  • Entries added with the /s parameter are static and do not time out of the arp cache. The entries are removed if the TCP/IP protocol is stopped and started. To create permanent static arp cache entries, place the appropriate arp commands in a batch file and use Scheduled Tasks to run the batch file at startup.

Examples

To display the arp cache tables for all interfaces, type:

arp /a

To display the arp cache table for the interface that is assigned the IP address 10.0.0.99, type:

arp /a /n 10.0.0.99

To add a static arp cache entry that resolves the IP address 10.0.0.80 to the physical address 00-AA-00-4F-2A-9C, type:

arp /s 10.0.0.80 00-AA-00-4F-2A-9C

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.