{
	"id": "979e4c90-0424-402a-ac08-cbd6d1e11a63",
	"created_at": "2026-04-06T00:20:01.035811Z",
	"updated_at": "2026-04-10T03:35:21.446528Z",
	"deleted_at": null,
	"sha1_hash": "b86d9b6d348396ba83b9d5d1b5e39bb267cefde0",
	"title": "Arp",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 51872,
	"plain_text": "Arp\r\nArchived: 2026-04-05 14:46:24 UTC\r\nDisplays and modifies entries in the Address Resolution Protocol (ARP) cache, which contains one or more tables\r\nthat are used to store IP addresses and their resolved Ethernet or Token Ring physical addresses. There is a\r\nseparate table for each Ethernet or Token Ring network adapter installed on your computer. Used without\r\nparameters, arp displays help.\r\nSyntax\r\narp [-a [InetAddr] [-N IfaceAddr]] [-g [InetAddr] [-N IfaceAddr]] [-d InetAddr [IfaceAddr]] [-s InetAddr\r\nEtherAddr [IfaceAddr]]\r\nParameters\r\n-a [ InetAddr ] [ -N   IfaceAddr ] : Displays current ARP cache tables for all interfaces. To display the ARP cache\r\nentry for a specific IP address, use arp -a with the InetAddr parameter, where InetAddr is an IP address. To display\r\nthe ARP cache table for a specific interface, use the -N IfaceAddr parameter where IfaceAddr is the IP address\r\nassigned to the interface. The -N parameter is case-sensitive.\r\n-g [ InetAddr ] [ -N   IfaceAddr ] : Identical to -a.\r\n-d   InetAddr [ IfaceAddr ] : Deletes an entry with a specific IP address, where InetAddr is the IP address. To\r\ndelete an entry in a table for a specific interface, use the IfaceAddr parameter where IfaceAddr is the IP address\r\nassigned to the interface. To delete all entries, use the asterisk (*) wildcard character in place of InetAddr.\r\n-s   InetAddr EtherAddr [ IfaceAddr ] : Adds a static entry to the ARP cache that resolves the IP address InetAddr\r\nto the physical address EtherAddr. To add a static ARP cache entry to the table for a specific interface, use the\r\nIfaceAddr parameter where IfaceAddr is an IP address assigned to the interface.\r\n/?   : Displays help at the command prompt.\r\nThe IP addresses for InetAddr and IfaceAddr are expressed in dotted decimal notation.\r\nThe physical address for EtherAddr consists of six bytes expressed in hexadecimal notation and separated\r\nby hyphens (for example, 00-AA-00-4F-2A-9C).\r\nEntries added with the -s parameter are static and do not time out of the ARP cache. The entries are\r\nremoved if the TCP/IP protocol is stopped and started. To create permanent static ARP cache entries, place\r\nthe appropriate arp commands in a batch file and use Scheduled Tasks to run the batch file at startup.\r\nhttps://technet.microsoft.com/en-us/library/bb490864.aspx\r\nPage 1 of 3\n\nThis command is available only if the Internet Protocol (TCP/IP) protocol is installed as a component in\r\nthe properties of a network adapter in Network Connections\r\nExamples\r\nTo display the ARP cache tables for all interfaces, type:\r\narp -a\r\nTo display the ARP cache table for the interface that is assigned the IP address 10.0.0.99, type:\r\narp -a -N 10.0.0.99\r\nTo add a static ARP cache entry that resolves the IP address 10.0.0.80 to the physical address 00-AA-00-4F-2A-9C, type:\r\narp -s 10.0.0.80 00-AA-00-4F-2A-9C\r\nFormatting legend\r\nFormat Meaning\r\nItalic Information that the user must supply\r\nBold\r\nElements that the user must type exactly as\r\nshown\r\nEllipsis (...)\r\nParameter that can be repeated several times in a\r\ncommand line\r\nBetween brackets ([]) Optional items\r\nBetween braces ({}); choices separated by pipe (|).\r\nExample: {even|odd}\r\nSet of choices from which the user must choose\r\nonly one\r\nCourier font Code or program output\r\nCommand-line reference A-Z\r\nhttps://technet.microsoft.com/en-us/library/bb490864.aspx\r\nPage 2 of 3\n\nSchtasks\r\nSource: https://technet.microsoft.com/en-us/library/bb490864.aspx\r\nhttps://technet.microsoft.com/en-us/library/bb490864.aspx\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://technet.microsoft.com/en-us/library/bb490864.aspx"
	],
	"report_names": [
		"bb490864.aspx"
	],
	"threat_actors": [
		{
			"id": "2864e40a-f233-4618-ac61-b03760a41cbb",
			"created_at": "2023-12-01T02:02:34.272108Z",
			"updated_at": "2026-04-10T02:00:04.97558Z",
			"deleted_at": null,
			"main_name": "WildCard",
			"aliases": [],
			"source_name": "ETDA:WildCard",
			"tools": [
				"RustDown",
				"SysJoker"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "256a6a2d-e8a2-4497-b399-628a7fad4b3e",
			"created_at": "2023-11-30T02:00:07.299845Z",
			"updated_at": "2026-04-10T02:00:03.484788Z",
			"deleted_at": null,
			"main_name": "WildCard",
			"aliases": [],
			"source_name": "MISPGALAXY:WildCard",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434801,
	"ts_updated_at": 1775792121,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/b86d9b6d348396ba83b9d5d1b5e39bb267cefde0.pdf",
		"text": "https://archive.orkl.eu/b86d9b6d348396ba83b9d5d1b5e39bb267cefde0.txt",
		"img": "https://archive.orkl.eu/b86d9b6d348396ba83b9d5d1b5e39bb267cefde0.jpg"
	}
}