arp - Check IP-to-MAC Address Mappings

The arp command displays and edits the table that maps IP addresses to MAC addresses (the ARP table).

When you communicate with a device on the same network (LAN), Windows looks up the other device’s MAC address from its IP address and temporarily remembers the result in the ARP table. The arp command lets you check what is stored there.

Basic Syntax of the arp Command

arp -a [<IP address>] [-N <interface IP address>]
arp -s <IP address> <MAC address> [<interface IP address>]
arp -d <IP address | *> [<interface IP address>]

Display the ARP Table

arp -a

－ □ ×

Command Prompt

Microsoft Windows [Version xx.x.xxxxx.xxx]

(c) 2026 Ribbit App Development All rights reserved.

 

C:\users\user>arp -a

Interface: 192.168.1.10 --- 0x7

Internet Address Physical Address Type

192.168.1.1 aa-bb-cc-11-22-33 dynamic

192.168.1.20 aa-bb-cc-44-55-66 dynamic

192.168.1.255 ff-ff-ff-ff-ff-ff static

224.0.0.22 01-00-5e-00-00-16 static

C:\users\user>

The IP and MAC address values differ from one environment to another. The output is shown as a block for each interface, such as a LAN adapter.

ff-ff-ff-ff-ff-ff is the broadcast address, and addresses starting with 01-00-5e- are multicast addresses. Neither is an ordinary device.

Find the MAC Address of a Specific IP Address

If you specify an IP address, only that device’s entry is displayed.

ping -n 1 192.168.1.20
arp -a 192.168.1.20

Communicating with the device using ping registers it in the ARP table. The trick is to run ping before arp -a.

Display a Specific Interface

If you have multiple adapters, such as Wi-Fi and wired, you can use -N to narrow down the interface to display. Specify the IP address assigned to that adapter (use it together with -a).

arp -a -N 192.168.1.10

Delete Entries

If an old mapping remains after replacing a router or reassigning an IP address and you cannot communicate, deleting the entry makes Windows learn it again. Run it in a Command Prompt that was run as administrator.

arp -d 192.168.1.20

arp -d *

Specifying * also deletes static entries added with -s. Even after deletion, a dynamic entry is registered again automatically the next time you communicate.

Add a Static Entry

With -s you can manually register the mapping between an IP address and a MAC address. Specify the MAC address as hexadecimal separated by -.

arp -s 192.168.1.20 aa-bb-cc-44-55-66

Static entries are removed when you restart. The IP address must also be one the PC can reach directly (on the same subnet). To keep an entry permanently, you need another method such as netsh interface ipv4 add neighbors. In normal use you almost never need to add a static entry, and registering a wrong value can stop communication, so be careful.

When You Want to Find Your Own MAC Address

arp displays entries for other devices; your own MAC address is not listed. You can check your own MAC address under “Physical Address” in ipconfig /all.

ipconfig /all

Extract a MAC Address in a Batch File

Combined with for /f, you can store the MAC address of a specified IP address in a variable.

@echo off
setlocal

set TARGET=%~1
if "%TARGET%"=="" (
  echo Usage: get-mac.cmd IP_address
  exit /b 1
)

ping -n 1 %TARGET% >nul

set MAC=
for /f "tokens=2" %%m in ('arp -a %TARGET% ^| findstr /r "[0-9a-f][0-9a-f]-[0-9a-f][0-9a-f]-"') do set MAC=%%m

if "%MAC%"=="" (
  echo Could not find the MAC address for %TARGET%.
  exit /b 1
)

echo MAC address for %TARGET%: %MAC%

findstr narrows the output to lines containing the MAC address format (a sequence like aa-bb-), and tokens=2 extracts the second item (the physical address) when the line is split on spaces.

Summary

Related Articles

Practice Questions