ARP Cache
Definition
A table held in memory that maps IP addresses to hardware (MAC) addresses for recently contacted hosts on the local network. ARP cache entries reveal which hosts a system has communicated with recently and can expose lateral movement paths not recorded in firewall logs.
- Function
- Maps IP addresses to MAC addresses
- Storage
- Volatile memory table
- Scope
- Recently contacted local network hosts
- Forensic value
- Reveals lateral movement not in firewall logs
Common questions
Why is the ARP cache considered volatile evidence that needs urgent capture?+
Entries typically expire and are overwritten within minutes, so if a responder does not capture the cache during live triage, the record of which local hosts a compromised system recently communicated with is lost once the machine is powered off or the entries age out.
How does ARP cache data complement firewall or network logs in an investigation?+
Firewall logs typically only record traffic crossing a monitored boundary, while ARP cache entries capture communication with any host on the same local broadcast domain, including lateral movement between machines on the same subnet that never crosses the firewall.
Related terms
- DNS Resolver Cache
- A temporary store of DNS query results held by the operating system. Entries reveal which domain names a host has recently resolved,...
- Live Response
- The process of collecting evidence and triage data from a running system without first powering it down. Preserves volatile artefacts that would...
- Order of Volatility
- The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and...
- Process Tree
- A structured representation of running processes showing each process alongside its parent. Malware frequently spawns command shells or other processes from unexpected...
- Trusted Response Kit
- A portable collection of statically compiled, cryptographically verified forensic tools stored on write-protected media. Used during live response to avoid executing potentially...