When computers access DNS information, the name and address mappings found are temporarily stored in an ARP (Address Resolution Protocol) cache so that the next time the same information is accessed, the search does not have to be done again. This information ages according to the TTL (Time-To-Live) value set when it is received, and at the end of its lifetime, such information must be updated.
When new information is received, a new TTL value is set. In general this automatic system retrieving, cleaning and updating information about name and address mappings works well. But sometimes outdated information manages to cause problems before it is reset. So, if the DNS name on a computer changes and the TTL value has not yet been reset, you will temporarily lose the ability to find that computer.
Deleting old information about name mappings
DNS administrators have a few tricks up their sleeves that can help reduce the negative impact of name changes, such as setting a lower TTL before changing the name so that old information is deleted faster and doesn't cause problems. However, you may find that it's easier to simply get rid of the old data and have your computer look up the DNS information again.
To do this, enter on the command line or delete arpcache(if the Interface IP context in Netsh is already installed). This will remove name and address mapping information for all interfaces configured on this computer.
Example of using clear arp cache
If you have several interfaces and you want to reset information for only one interface, specify the desired interface using InterfaceName, for example:
- netsh interface ip delete arpcache
- delete arpcache
When working in local network It happens that a node or server on the network suddenly becomes inaccessible, while it is visible from other computers and there are no problems with access. Sometimes the reason for this may be that this computer has The MAC address of the network adapter has changed. In this case, on a computer from which the node is inaccessible, arp cache was not updated.
What is arp cache?
ARP cache this is actually a table of correspondence between IP addresses and physical addresses network adapters. This table is updated whenever necessary, but sometimes it may not update. The reason may be system failure or ARP spoofing attack to the computer, after which some nodes on the network may be unavailable and some websites may not open.
How to manually update the arp cache on Windows7 and Windows 8?!
View ARP table on a computer running operating system Windows can be done from the command line. To open the command line, you need to press the button Start and in the program search bar write Command line
. As a result of the search, you will see a shortcut to launch command Windows strings. To run it with Administrator rights, you need to right-click on the shortcut: 
In the opened context menu select an item Run as Administrator. For ARP table view enter the command arp -a :
After that, to clear the ARP cache you need to enter the command: netsh interface ip delete arpcache
After executing the command, The ARP cache will be cleared.
Windows OS works very carefully with the network. So gentle that out-of-date node data can be stored in cache for years.
Symptoms of outdated data can range from:
- a ping by name goes to one address, and an attempt to connect to a terminal or resource by the same name goes to another;
- when the gateway is physically changed (one device is replaced by another, but with the same IP address), the Internet disappears;
- IP address conflicts appear on the local network, which is indicated by a balloon above the clock;
- Remote printers stop working
- and a lot of other pleasures
Why does this happen? Because there are several network caches, and the data in them ceases to correspond not only to the real state of affairs on the network, but also to each other.
It can be cured using a completely standard procedure.
0. Disconnect from the local network
A running network may prevent all existing caches from being cleared correctly.
1. Clear the ARP cache
On a local network, computers communicate with each other not via IP, but via MAC addresses, that is, at a lower (link) level.
When accessing a remote computer via IP, the first step is a broadcast request to obtain its physical address. The received address is dropped into the ARP cache to speed up subsequent requests. And only then is there a connection to the remote machine, but not via IP, but via MAC address.
In normal mode, the ARP cache entry is stored for two minutes from the last access, but no more than 10 minutes.
2. Clear the NetBIOS cache
This cache contains mappings of computers' NetBIOS names to their IP addresses. If you are lucky and there is also a WINS server on the network (something like DNS for NetBIOS names), it makes sense to clean that too.
Immediately after clearing this cache, entries from the LMHOSTS file (%SystemRoot%\System32\drivers\etc\lmhosts) are loaded there.
Many people consider the NetBIOS protocol to be outdated, but Microsoft treats it like a bag of dust. Without it, Windows behaves inappropriately on the network. At the same time, with it it creates a wild broadcast flood on the ports.
The kido virus favors the use of NetBIOS.
3. Clear the DNS cache
ipconfig /flushdns
Everything is clear here. The DNS cache is a mapping of hosts' network names to their IP addresses.
It also loads records from HOSTS file(%SystemRoot%\System32\drivers\etc\hosts)
By the way, viruses love to change the location of the HOSTS file.
And the path to it is set in the registry, branch HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters , key DataBasePath , type REG_EXPAND_SZ .
If the command returns an error, you need to start (or restart) the DNS client service.
4. Restore connection to the local network
5. Update network settings via DHCP
The command sends a request to the last used DHCP server (the address of this server) to obtain network settings.
All the described procedures can be done in crowds and from graphics.
In HR: Start → Control Panel → Network connections.
On required connection press the right mouse button and select from the menu “ Restore" After this, the following operations will be performed:
- Broadcast DHCP request. Responses come from all DHCP servers.
- Clearing the ARP cache
- Clearing the NetBIOS cache. With subsequent downloading of the LMHOSTS.
- Clearing the DNS cache. With subsequent downloading of the HOSTS file.
- Attempting to register in WINS (relevant only if it exists)
- Attempting to register in DNS (relevant only for AD)
Unfortunately, this easy method does not work well and does not always work.
In a TCP/IP connection, ARP (Address Resolution Protocol) plays a crucial role. Therefore, if there are some problems loading some sites or lack of ping of IP addresses, then try clearing the arp cache. It is worth noting that this procedure can only be performed from the command line.
