ARP Cache Behavior in Windows 8, 7 and Vista

This post applies to Windows 8, 7, Vista, 2012 and 2008.

If you depend on Ping Scanning to populate your Windows system ARP Cache, you may be in for a surprise. While Pinging a large number of local subnet IPs may populate your ARP cache, you may be surprised find that there are now limits in the size of the cache. In fact the cache size might be much smaller than you think.

When you Ping or send any IP packet for that matter to an IP address, the operating system checks the ARP cache to see if there is a MAC address for that IP. If it cannot find the IP, it sends an ARP request to the target IP whether in it's your subnet or not. If the target IP is in your subnet, the device responds with an ARP reply so that communication can begin on the MAC address level. That ARP reply contains an IP/MAC address pair that gets added to your ARP cache. If the IP is outside your subnet, the ARP reply comes from the default gateway and that IP/MAC pair gets added to the ARP cache.

We recently had a user move his Managed Switch Port Mapping Tool from Windows XP to Windows 7. He emailed to ask why he saw MAC Addresses but very few IP addresses. After much research we found that the ARP cache is no longer managed the way it was in XP and now defaults to a tiny 256 entry cache. And, what's more, the user found that his company had set the ARP cache to 10 IP/MAC addresses.

How to find out what your ARP cache size is now:
1. open a command prompt
2. enter this command and press Enter:
netsh interface ipv4 show global

3. make note of the Neighbor Cache Limit (second from the top). On this system it is 256 entries per interface.



While 256 may be enough for normal users, if you are ping scanning an IP range larger than 256 devices (like in a 10.x.x.x network) and expecting to see more results, you won't see them. In fact, our user was only seeing 10 because his company had set it at 10.

The good news is you can set your ARP cache size limit to a much larger number - here's how:
1. open an administrator command prompt
2. enter this command and press Enter:
netsh interface ipv4 set global neighborcachelimit = 4096

Want to learn more? Please visit http://support.microsoft.com/kb/949589

www.SwitchPortMapper.com
www.NetScanTools.com

How to save XML results files from Switch Lists

This question has come up frequently from people who are using Managed Switch Port Mapping Tool v2.x in Switch List mode (this mode means two or more switches are mapped in succession).

To make individual XML files for each switch as it goes, go to the Switch List Editor and make sure 'save switch results as xml files after each switch mapping' is checked. This setting is different for each separate switch list and should be on by default.

Next, change your command line to:
spmap.exe -maplist TheSwitchListName -postexit

This tells the app to map the named list and exit when complete.

Here is the part people have a problem with: The files will be saved to either My Documents or the last used directory you saved XML files to from the menu.

You can override the path manually by mapping any switch or reloading results from history, then right click and select Export XML. Save the results to the directory you want everything to go to. When you run the switch list, it will save in that last location.

The XML filenames will have the format:
switch-ip_a.ip_b.ip_c.ip_d-unixTimestamp.xml

Please be aware that the command line option  -xml D:\switch.xml only works for a single switch.

This will be documented more fully in a subsequent release. You can get the application at http://www.SwitchPortMapper.com/