ARP Command Guide - Display and Modify ARP Cache in Windows

The arp command is a Windows Command Prompt utility that displays and modifies the Address Resolution Protocol (ARP) cache, which maps IP addresses to physical MAC (Media Access Control) addresses on your local network. Use arp -a to view all entries, arp -d to delete entries, and arp -s to add static mappings for network troubleshooting and security.

Whether you're diagnosing duplicate IP conflicts, identifying devices on your network by MAC address, clearing stale ARP entries after router changes, or hardening network security with static ARP bindings, mastering the arp command gives you direct access to the layer that bridges IP addresses to physical hardware. Network administrators and IT professionals rely on arp for LAN diagnostics, security audits, and resolving connectivity issues at the data-link layer.

This comprehensive guide covers arp syntax, all major switches (-a, -d, -s, -g, -N), practical examples for common scenarios, troubleshooting tips, related commands, and frequently asked questions. By the end, you'll confidently manage ARP cache entries from the command line.

What Is the ARP Command?

The arp (Address Resolution Protocol) command has been part of Windows networking since the early TCP/IP stack. ARP resolves IP addresses to MAC addresses so that data can be delivered to the correct physical device on a local network segment. The arp command lets you view the cache Windows maintains of these mappings and manually add or remove entries when needed.

ARP operates at the data-link layer (Layer 2) of the OSI model. When your computer needs to send a packet to an IP address, it first checks the ARP cache. If no mapping exists, it broadcasts an ARP request; the device with that IP responds with its MAC address, and the mapping is cached. The arp command provides command-line access to this cache for diagnostics and manual management.

The command runs in Command Prompt (CMD), PowerShell, and Windows Terminal on all Windows versions including Windows 11, Windows 10, and Windows Server editions. Administrator privileges are required to add or delete ARP entries.

ARP Command Syntax

arp [-a [InetAddr] [-N IfAddr]] [-g [InetAddr] [-N IfAddr]] [-d InetAddr [IfAddr]] [-s InetAddr EtherAddr [IfAddr]]

Parameters and Switches

Parameter	Description
-a [InetAddr]	Display all ARP cache entries; optionally filter by IP address
-g [InetAddr]	Same as -a; display ARP cache entries
-d InetAddr [IfAddr]	Delete the ARP entry for specified IP; optionally specify interface
-s InetAddr EtherAddr [IfAddr]	Add static ARP entry: IP maps to MAC address
-N IfAddr	Display ARP entries for the specified network interface

Parameters and Options Explained

Display ARP Cache (-a, -g)

Running arp -a or arp -g without arguments displays all ARP cache entries for all interfaces. Each entry shows the IP address, corresponding MAC (physical) address, and type (dynamic or static). Dynamic entries are learned automatically; static entries are manually added.

Example – display all ARP entries:

arp -a

Output:

Interface: 192.168.1.105 --- 0x2
  Internet Address      Physical Address      Type
  192.168.1.1           00-11-22-33-44-55     dynamic
  192.168.1.10          00-aa-bb-cc-dd-ee     dynamic

Example – display ARP entry for specific IP:

arp -a 192.168.1.1

Delete ARP Entry (-d)

The -d switch removes an ARP cache entry. Use this when you suspect a stale or incorrect mapping—for example, after changing a device's IP address or resolving duplicate IP conflicts.

Example – delete ARP entry for gateway:

arp -d 192.168.1.1

Output: 192.168.1.1 - deleted

Note: Requires administrator privileges. The entry will be repopulated when traffic is next sent to that IP.

Add Static ARP Entry (-s)

The -s switch adds a permanent (static) ARP entry that maps an IP address to a specific MAC address. Static entries persist until reboot and are used for security (ARP spoofing prevention) or when dynamic resolution fails.

Example – add static ARP entry for gateway:

arp -s 192.168.1.1 00-11-22-33-44-55

Note: Requires administrator privileges. Use with caution; incorrect mappings will break connectivity to that IP.

Examples

Example 1: View All ARP Cache Entries

Scenario: You need to see which devices your computer has recently communicated with on the local network.

Command:

arp -a

Explanation: Displays the complete ARP cache. Look for the "Physical Address" column to identify devices by MAC address.

Example 2: Find MAC Address of Default Gateway

Scenario: You need the router's MAC address for MAC filtering or documentation.

Command:

arp -a 192.168.1.1

Explanation: If 192.168.1.1 is your default gateway, this shows its MAC address. Run ipconfig first to confirm your gateway IP.

Example 3: Clear Stale ARP Entry After IP Change

Scenario: A server's IP was changed; your computer still has the old MAC mapping.

Command:

arp -d 192.168.1.50

Explanation: Deletes the cached entry. The next time you connect to 192.168.1.50, Windows will perform a fresh ARP resolution.

Example 4: Add Static ARP for Critical Server

Scenario: You want to prevent ARP spoofing by binding your gateway's IP to its known MAC address.

Command:

arp -s 192.168.1.1 00-11-22-33-44-55

Explanation: Creates a static mapping. Verify the MAC address with arp -a before adding. Incorrect entries will break connectivity.

Example 5: Display ARP for Specific Interface

Scenario: You have multiple network adapters and want ARP entries for one interface only.

Command:

arp -a -N 192.168.1.105

Explanation: Shows ARP entries for the interface with IP 192.168.1.105. Use ipconfig to list interface addresses.

Example 6: Troubleshoot Duplicate IP

Scenario: Two devices may have the same IP; you want to clear cache and observe which MAC responds.

Command:

arp -d 192.168.1.100
ping 192.168.1.100
arp -a 192.168.1.100

Explanation: Delete cache, ping to trigger ARP, then view which MAC address was learned. Compare with expected device MACs.

Example 7: Document Network Devices

Scenario: Create a list of IP-to-MAC mappings for network inventory.

Command:

arp -a > C:\network-arp-table.txt

Explanation: Saves ARP cache to file. Run after pinging key devices to ensure cache is populated.

Example 8: Verify Static Entry

Scenario: Confirm that a static ARP entry was added correctly.

Command:

arp -a

Explanation: Static entries show "static" in the Type column; dynamic entries show "dynamic".

Common Use Cases

• Duplicate IP Detection – Clear ARP cache and ping the conflicting IP; check which MAC responds to identify the duplicate device.

• MAC Address Lookup – Find the physical address of any device you've recently communicated with on the local network.

• ARP Spoofing Prevention – Add static ARP entries for critical hosts (gateway, servers) to prevent man-in-the-middle attacks via ARP poisoning.

• Post-Router-Change Cleanup – After replacing a router or changing its IP, delete old gateway ARP entries so new mappings are learned.

• Network Documentation – Export ARP cache after pinging key devices to document IP-MAC mappings for inventory or troubleshooting.

• Troubleshooting Connectivity – If you can ping by IP but not by name, or have intermittent connectivity, stale ARP entries may be the cause; clear and retest.

• VLAN and Segment Verification – On multi-interface systems, use -N to verify ARP cache per interface and confirm correct segment membership.

• Scripted Network Audits – Use arp in batch scripts with ping to build device discovery and mapping tools.

• Security Audits – Compare current ARP cache against known-good MAC addresses to detect unauthorized devices or ARP spoofing.

• Virtual Machine Networking – When VMs share a host, ARP cache helps verify correct IP-MAC bindings across virtual switches.

Tips and Best Practices

• Run as Administrator – Adding (-s) or deleting (-d) ARP entries requires elevated privileges. Right-click Command Prompt → "Run as administrator".

• Verify MAC Before Static Add – Always confirm the correct MAC address with arp -a after pinging the target before adding a static entry. Wrong MAC = broken connectivity.

• Static Entries Are Temporary – Static ARP entries are lost on reboot. Use persistent scripts or Group Policy if you need permanent static bindings.

• Combine with Ping – ARP cache populates when you communicate with a host. Use ping 192.168.1.x before arp -a to ensure entries exist for devices you want to inspect.

• Use -N for Multi-Interface Systems – On servers or workstations with multiple NICs, specify the interface to avoid confusion about which segment's ARP cache you're viewing.

• Document Static Entries – If you add static ARP entries for security, document them. After a reboot they're gone; you'll need to re-add them or script the process.

• Don't Overuse Static ARP – Reserve static entries for critical infrastructure (gateway, key servers). Dynamic resolution works well for most hosts.

• Check Type Column – "dynamic" means learned automatically; "static" means manually added. Helps verify your changes took effect.

Troubleshooting Common Issues

ARP Entry Not Updating

Problem: You changed a device's IP but arp still shows the old MAC.

Solution: Run arp -d <old-ip> to delete the stale entry. Ping the new IP to repopulate. If the device uses the same MAC, the cache will update.

Prevention: Clear ARP cache after making IP changes on critical devices.

"ARP: bad argument" or Invalid Syntax

Problem: Command fails with syntax error.

Solution: Verify switch format: use -a not /a. Ensure IP addresses are valid and MAC format is XX-XX-XX-XX-XX-XX (hex pairs separated by hyphens).

Prevention: Copy syntax from arp /? or this guide.

Access Denied When Adding/Deleting

Problem: arp -s or arp -d fails with "Access is denied."

Solution: Run Command Prompt as administrator. Right-click cmd.exe → "Run as administrator".

Prevention: Use an elevated command prompt for any ARP modifications.

Static Entry Breaks Connectivity

Problem: After adding static ARP, you can no longer reach the host.

Solution: The MAC address may be wrong. Delete the entry: arp -d <ip>. Verify correct MAC from another device or the target's configuration, then re-add if needed.

Prevention: Always verify MAC with arp -a after a successful ping before adding static entry.

ARP Cache Empty

Problem: arp -a shows no entries or very few.

Solution: ARP cache only contains entries for hosts you've communicated with. Ping key devices (gateway, DNS server) first, then run arp -a.

Prevention: Ping your gateway and a few local hosts before auditing ARP cache.

Related Commands

ipconfig – View IP Configuration

While arp shows IP-to-MAC mappings, ipconfig displays your computer's IP address, subnet mask, gateway, and DNS. Use ipconfig to find your gateway IP before querying it with arp.

ping – Trigger ARP Resolution

Ping a host to populate the ARP cache before running arp. If you haven't communicated with a device, it won't appear in the cache.

getmac – Display Local MAC Addresses

getmac shows your computer's MAC addresses for each adapter. Use arp to see other devices' MACs; use getmac for your own.

netstat – Network Connections

netstat shows active TCP/UDP connections. Combine with arp to map connection IPs to physical addresses for full network visibility.

nbtstat – NetBIOS Names

nbtstat resolves NetBIOS names to IPs. For IP-to-MAC mapping, use arp. For name-to-IP in Windows networks, use nbtstat.

Frequently Asked Questions

What does arp -a do?

arp -a displays all entries in the ARP cache, showing the mapping between IP addresses and MAC (physical) addresses for devices your computer has recently communicated with on the local network.

How do I clear the ARP cache in Windows?

Use arp -d <ip> to delete a specific entry, or arp -d * (on some Windows versions) to clear all. Alternatively, disable and re-enable the network adapter, or run netsh interface ip delete arpcache for a full flush.

What is the difference between dynamic and static ARP entries?

Dynamic entries are learned automatically when you communicate with a host; they expire after a timeout. Static entries are manually added with arp -s and persist until reboot; they prevent ARP spoofing but require correct MAC address.

Do I need administrator rights for arp?

Viewing the cache with arp -a works for standard users. Adding (-s) or deleting (-d) entries requires administrator privileges.

How do I find the MAC address of an IP address?

Run ping <ip> to ensure the host is in the ARP cache, then run arp -a <ip> to display the MAC address for that IP. Or use arp -a and find the IP in the list.

Why would I add a static ARP entry?

Static ARP entries prevent ARP spoofing attacks by binding critical IPs (like your gateway) to known MAC addresses. They also help when dynamic resolution fails. Use sparingly and verify the MAC first.

Does arp work across routers?

No. ARP operates only on the local network segment (same subnet). To reach hosts beyond your gateway, you need the gateway's MAC; arp shows that. Hosts on other subnets are not in your ARP cache.

How long do dynamic ARP entries last?

Windows typically keeps dynamic ARP entries for 2–10 minutes of inactivity, depending on version and configuration. They are refreshed when you communicate with the host again.

Can I use arp in PowerShell?

Yes. Run arp -a or other arp commands directly in PowerShell. The arp.exe utility works the same in CMD and PowerShell.

What MAC address format does arp -s require?

Use hyphen-separated hex pairs: 00-11-22-33-44-55. Six groups of two hexadecimal digits. Colons (00:11:22:33:44:55) may work on some versions but hyphens are standard for Windows arp.

How do I delete all ARP entries?

Use netsh interface ip delete arpcache for a complete flush (requires admin). Or disable and re-enable the network adapter. The arp -d command deletes one entry at a time by IP.

Is arp the same on Linux?

The concept is the same, but syntax differs. Linux uses arp -a to display and arp -d to delete, similar to Windows. Adding static entries uses arp -s on both. Check man arp on Linux for details.

Quick Reference Card

Command	Purpose	Example
arp -a	Display all ARP cache entries	View all IP-MAC mappings
arp -a 192.168.1.1	Display entry for specific IP	Find gateway MAC
arp -g	Same as -a	Alternative display
arp -d 192.168.1.1	Delete ARP entry	Clear stale mapping
arp -s 192.168.1.1 00-11-22-33-44-55	Add static entry	Prevent ARP spoofing
arp -a > file.txt	Save cache to file	Document network
ping 192.168.1.1 then arp -a	Populate and view	Ensure entry exists

Try ARP Yourself

Practice the arp command in our interactive Windows Command Simulator to view and manage ARP cache entries safely. Explore our Commands Reference for ipconfig, ping, netstat, and other network tools. For related guides, see ipconfig, ping, and netstat.

Summary

The arp command is an essential network troubleshooting tool that provides direct access to the ARP cache—the mapping between IP addresses and MAC addresses on your local network. Use arp -a to view entries, arp -d to delete stale mappings, and arp -s to add static entries for security or when dynamic resolution fails.

Key use cases include duplicate IP detection, MAC address lookup, ARP spoofing prevention, and post-configuration cleanup. Always run as administrator when modifying the cache, verify MAC addresses before adding static entries, and combine with ping to populate the cache before auditing. The arp command complements ipconfig, ping, and netstat for comprehensive network diagnostics.