To inspect the Windows ARP cache without changing it, run arp -a. When several adapters appear, use arp -a -N followed by the local adapter’s IPv4 address to focus the output. This is an evidence-collection step, not a repair: a cached address does not prove a device is reachable now, and an absent entry does not prove the device is offline.
Understand what this snapshot can answer
ARP associates IPv4 addresses with link-layer addresses on a local network. Windows can maintain separate tables for different interfaces, so an Ethernet connection, Wi-Fi connection and virtual adapter can make the output confusing. The useful question is not simply whether an address appears somewhere. It is whether the expected neighbour appears under the interface involved in the problem.
This is not a complete inventory of every device on your network. It also does not list every remote website’s physical address. For traffic routed off the local link, the relevant local neighbour is normally the next-hop router, rather than the distant server. IPv6 neighbour discovery is a separate mechanism; do not interpret this IPv4 inspection as an IPv6 health check.
Collect the unfiltered view first
Open Command Prompt on the affected Windows computer and enter this read-only command:
arp -aLook at each interface heading before reading its rows. Record the local interface address, the internet address being mapped, the physical address and the entry type. A dynamic entry is learned information, not an assurance that the mapping remains correct forever. A static entry should not automatically be treated as a personally configured device: inspect its address and context before drawing that conclusion.
For a support ticket, note the observation time, whether the computer was using Ethernet or Wi-Fi, and whether a VPN was connected. Capture only the rows needed for the investigation. Internal addresses and physical addresses can reveal network details, so avoid posting a full table on a public forum.
Filter by the local adapter address
Microsoft documents the case-sensitive -N parameter for selecting a table by interface IP address. In the following example, 10.0.0.99 represents an address actually assigned to the Windows adapter you want to inspect. Replace it with the address shown for your adapter, not the router’s address.
arp -a -N 10.0.0.99Do not copy that example address unchanged unless it really belongs to your computer. If it selects nothing useful, return to the unfiltered output and compare the interface headings. A filter using yesterday’s Wi-Fi address may be wrong after reconnecting or changing networks.
You can also request the cached entry for a particular neighbour. Here, 10.0.0.1 is only an illustrative local router address:
arp -a 10.0.0.1This queries existing cache information; it is not a command to discover all devices or contact that router. Preserve the table heading with any copied row so the observation keeps its interface context.
Interpret missing or surprising entries carefully
Suppose a printer is missing from the table. That observation alone does not establish a printer fault. The computer may not have needed a current mapping, the printer may be reached through a router, or you may be inspecting the wrong interface. Confirm the intended destination address and route before changing anything.
Likewise, an unexpected physical address is a reason to investigate, not immediate proof of an attack. Compare with an authorized network record and ask whether equipment, addressing or redundancy changed. Do not add a guessed static mapping to make the table look right.
If the next-hop choice is unclear, use the separate Windows route-print inspection workflow. That helps answer which route is selected; it does not replace examining the correct ARP table.
Checklist before escalating
- Keep the interface heading and relevant rows together.
- Distinguish the local adapter address from the neighbour address.
- Record when the snapshot was taken and the connection in use.
- Explain the symptom separately from your interpretation of the cache.
- Avoid deletion and static-entry commands during initial collection.
Should I clear the cache first? Not for this workflow. Clearing it removes evidence and changes state. These display-only examples need no rollback because they do not modify mappings.
Source: Microsoft Learn’s arp reference documents display options, interface selection and the separate modification parameters. These examples were checked against that reference, not executed on a Windows host here.
Safety: This tutorial is for educational purposes. Test carefully before production use. The site owner is not responsible for misuse, damage, data loss or production issues.
