Question

In my latest project I use GetIpNetTable for accessing the Windows ARP-Table from C# using .NET

I noticed, when I looked at the MAC Addresses, that the last two bytes (7 and 8) of my entries kept changing!
As MAC addresses usually have only 6 Bytes, I wondered what these two bytes contain…

See http://msdn.microsoft.com/en-us/library/cc704859%28v=prot.10%29.aspx

ypedef struct _MIB_IPNETROW {
  DWORD dwIndex;
  DWORD dwPhysAddrLen;
  BYTE bPhysAddr[8]; // WHY 8 BYTES??
  DWORD dwAddr;
  DWORD dwType;
} MIB_IPNETROW, 
 *PMIB_IPNETROW;

Answer 1

As a link layer isn’t always Ethernet, the physical address isn’t always MAC and therefore not always 48-bit. I suppose this field contains an EUI-64 address, which in the case of Ethernet is generated by inserting FF-FF into the middle of the MAC EUI-48 address.