TechKnowSurge
CompTIA Network+ 5.5 Cisco CCNA 1.10 Cisco CCST Networking 5.3 CompTIA A+ Core 2 1.2 CompTIA A+ Core 2 2.5
TechKnowSurge Catalog Videos DEMO: ARP Tables
VideoNetworkFree

DEMO: ARP Tables

The ARP table maps IP addresses to MAC addresses so devices on a local network can communicate at the hardware level. This content demonstrates how to view, interpret, and clear the ARP table using Windows command prompt tools.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Network communication on a local area network operates at the MAC address level, meaning that even when devices are identified and addressed by IP, the underlying hardware still requires a MAC address to deliver each frame. The ARP table is what bridges that gap, storing a dynamic record of IP-to-MAC address mappings that the operating system builds and updates automatically as traffic flows across the network. On a Windows machine, the arp -a command displays the full ARP table, organized by network interface. Each entry shows an IP address paired with its resolved MAC address and indicates whether the entry was learned dynamically or configured statically. In a setup with multiple active interfaces, such as both a wired and a wireless adapter, each interface maintains its own section of the table. Clearing the ARP table with arp -d requires administrator privileges and removes all cached entries. However, on a machine with an active connection — such as a remote desktop session — the relevant mapping reappears almost immediately because the system must resolve the MAC address again to keep the session alive. This behavior illustrates how ARP operates continuously in the background, resolving addresses on demand whenever a device needs to communicate with another host on the same local network segment.

What you'll learn

What's covered

ARP Table Overview

Aligned to

CompTIA Network+
5.5 Given a scenario, use the appropriate tool or protocol to solve networking issues.
Cisco CCNA
1.10 Verify IP parameters for Client OS
Cisco CCST Networking
5.3 Run basic diagnostic commands and interpret the results
CompTIA A+ Core 2
1.2 Given a scenario, use the appropriate Microsoft command-line tool.
2.5 Given a scenario, manage and configure basic security settings in the Microsoft Windows OS.

Key terms

Address Resolution Protocol
ARP
A protocol used to map an IP address to a physical MAC address on a local network.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
ARP Cache
A temporary table stored in memory that holds recent IP-to-MAC address mappings discovered through ARP.
Least Privilege
A security principle that grants users and systems only the minimum access rights needed to perform their functions.

Transcript

We know that we have to use MAC addresses to communicate on the local area network. And if we're used to using IP addresses, or the machines are communicating at the IP address level, then it still has to get a MAC address to send that communication out on a local area network.

So to do that, I'm going to click the start button, and I'm going to type in cmd to bring up a command prompt. And with the command prompt up, I'm going to type in arp -a, or ARP all. I want to see all of the table here.

So we can see that there's two interfaces. It has this 192.168.74.12, and this is actually the wireless interface, which is 192.168.42.45. So 42.45, that's the address that's assigned to this machine. We're going to call this our demo laptop because I'm demoing on it. And I'm actually remoted into it from my working laptop, so I'm going to call this other machine here that I'm remoting in from my working laptop.

So it needs to know a MAC address to communicate back and forth. And I take a look, and there is the MAC address of my working laptop.

Clearing the ARP Table

Now what I'm going to do is I'm going to run through the process of deleting this table and see how fast it populates. It should be really quick, and it should be really quick because it's making this connection. There's a remote connection between these two devices, and so as soon as I clear this out, it instantly has to go and find out this data again. So that's exactly what I'm going to do.

If I were to type this right now, I'm going to do arp -d, and it's actually going to give me a warning because I need elevated privileges on this. So to get elevated privilege on a command prompt, I'm going to open up my Windows again, hit cmd, but instead of hitting enter to open this up, I'm going to right click on it and say run as administrator. It's going to prompt me, make sure this is what I want. Yes, it is.

Now I'm going to type in, I'll do this one more time, arp -a. We can see the table is populated with quite a few entries. I'm going to clear this out with a dash d to delete it, and then immediately I'm going to go back and type that in. We can see it's cleared out all of the entries with the exception of the ones. Well, it's cleared everything out, but it really quickly had to once again, because there's an active connection between my working laptop and my demo laptop. It had to really quickly go out there and discover what the MAC address of that laptop is again.

So there is the ARP table. It's pretty fascinating. You can see some multicast address in there, you can see some interesting information in there. So it might be kind of fun to pull that up and take a look at that.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →