Last Updated on July 26, 2026
ARP, which stands for Address Resolution Protocol is a protocol used to map a MAC address (or hardware address) to an IP address. It is responsible for resolving the IP address to the MAC address of the destination computer or device during network communication. The MAC address is what is used to determine the destination of the information being sent.
Keep in mind that if the destination computer is not on the same network then ARP will learn the MAC address of the next hop used to get to the next network and so on until it reaches its final destination. Once this information is obtained it will be kept in the ARP table or cache of that computer to be used for future network communication.
When one computer needs to communicate with another it will use the destination computers IP address to determine if that computer is on the same network or subnet as itself. Once it determines that the computer is on the same network then it will send out an ARP broadcast for the MAC address of the destination computer.
If it’s not on the same network then it will send that broadcast to the default gateway or router which will use its routing table to determine where to send the packet based on the destination IP address. The packet will still contain the IP address of the destination computer it is trying to reach. The following illustration shows an ARP broadcast for computers on the same network.
Using the Windows ARP Command Line Tool
1. Understand the ARP Cache
When a computer resolves a MAC address to an IP address then it will keep that mapping information in its memory for a short amount of time. You don’t want to have this ARP cache last too long because things change on the network and then you will not have the most up to date information. You can use the ARP command to view and modify these entries in the ARP cache or table. You can also use ARP to find duplicate IP addresses and to find invalid entries in the ARP table.
2. View All ARP Entries
The ARP command uses various switches for different functions. The -a switch displays current ARP entries by interrogating the current protocol data. If inet_addr is specified, the IP and Physical addresses for only the specified computer are displayed. If more than one network interface uses ARP, entries for each ARP table are displayed. The -g switch performs the exact same function as the -a switch.
3. View Verbose ARP Entries
The -v switch displays current ARP entries in verbose mode. All invalid entries and entries on the loop-back interface will be shown. This provides significantly more data for deep troubleshooting.
4. Target Specific Network Interfaces
The -N if_addr switch displays the ARP entries for the network interface specified by if_addr. If present, this specifies the Internet address of the interface whose address translation table should be modified. If not present, the first applicable interface will be used.
5. Delete Specific ARP Hosts
The -d switch deletes the host specified by inet_addr. The inet_addr parameter specifies an internet address. The inet_addr variable may be wildcarded with an asterisk (*) to instantly delete all hosts from the table.
6. Add Permanent ARP Hosts
The -s switch adds the host and associates the Internet address inet_addr with the Physical address eth_addr. The eth_addr parameter specifies a physical hardware address. The Physical address is given as 6 hexadecimal bytes separated by hyphens. The entry is permanently saved to the cache.
Analyzing the ARP Command Output
1. Execute the Basic ARP Command
As you can see from the list of switches there are various functions you can perform using ARP. One of the most commonly used switches is –a which will show all the cached ARP entries on your computer. Open a command prompt and type arp -a to see this table.
2. Review the ARP Results
Here is an example of the ARP command output with the -a switch. It clearly lists the Internet Address next to the Physical Address. It also lists whether the IP allocation was static or dynamic.
3. Determine if You Need to Use ARP
ARP is not going to be too useful on your home network because of its overall simplicity. But in a corporate environment that has multiple networks and subnets, it can come in real handy to troubleshoot host to host communication problems.
