Windows arp clear cache

An ARP (Address Resolution Protocol) is a communication protocol that works on a “Physical (Data-Link)” layer of a TCP/IP stack and is used to discover a MAC address of a device on a LAN (local-area network) based on its IP address.

An ARP table is used to store the discovered pairs of the MAC and IP addresses.

In this note i will show how to display the ARP table and how to clear the ARP cache using the Windows arp command.

Cool Tip: How to show a routing table in Windows! Read more →

Show ARP Table

To display the current ARP table in Windows, use the arp command with the -a option:

C:\> arp -a

Interface: 192.168.1.31 --- 0x7
  Internet Address    Physical Address     Type
  192.168.1.1         60-35-c0-6b-a2-b7    dynamic
  192.168.1.255       ff-ff-ff-ff-ff-ff    static
  224.0.0.22          01-00-5e-00-00-16    static
  224.0.0.252         01-00-5e-00-00-fc    static

Show the ARP table in a verbose mode:

C:\> arp -av

To record an IP and MAC address of a device on a LAN to the ARP table, simply ping it:

C:\> ping 192.168.1.95

Pinging 192.168.1.95 with 32 bytes of data:
Reply from 192.168.1.952: bytes=32 time=18ms TTL=64

C:\> arp -a

Interface: 192.168.1.31 --- 0x7
  Internet Address    Physical Address     Type
  192.168.1.1         60-35-c0-6b-a2-b7    dynamic
  192.168.1.95        d6-58-01-33-dd-bc    dynamic
  192.168.1.255       ff-ff-ff-ff-ff-ff    static
  224.0.0.22          01-00-5e-00-00-16    static
  224.0.0.252         01-00-5e-00-00-fc    static

To discover all the devices on a LAN, you can ping them all using this one-liner (adjust the IP of your network):

C:\> FOR /L %i IN (1,1,254) DO ping -n 1 -w 100 192.168.1.%i | FIND /i "Reply"

Clear ARP Cache

To clear an ARP cache it is required to open an elevated command prompt, otherwise you may receive an error as follows: “The ARP entry deletion failed: The requested operation requires elevation.”

To start the elevated command prompt, press the ⊞ Win keybutton to open the start menu, type in cmd to search for the command prompt and press the Ctrl + Shift + Enter to start the command prompt as an administrator.

To clear the ARP cache in Windows, use the arp command with the -d option:

C:\> arp -d

How Does ARP Work – Explained

When one computer wants to communicate with another computer on the same LAN, it creates an IP packet with the source and destination IP addresses carrying the data from an application and encapsulates it in an Ethernet frame with the source and destination MAC addresses.

Address Resolution Protocol: The sending computer obviously knows its source MAC address, but how does it know the destination MAC address? That’s where ARP comes into play!

To find out a MAC address of the destination computer (if it is not in the ARP cache yet), it sends an ARP request to the broadcast MAC address ff:ff:ff:ff:ff:ff (to the all devices on the LAN), and is basically asking:

Who has IP 192.168.1.95 and what is your MAC address?

The destination computer receives the message and replies with an ARP reply:

That’s me! And my MAC address is xx:xx:xx:xx:xx:xx

The source computer adds the MAC and IP addresses of the destination computer to its ARP table and starts sending the data.

Cool Tip: Check if TCP port is opened in PowerShell! Read more →

ARP or Address Resolution Protocol in Windows is responsible for resolving IP addresses to MAC addresses to speed up connection over a local network. So instead of asking the router where a particular device is, again, it would simply use the already resolved IP to connect quickly. To get this done, it maintains a cache named ARP Cache. This post helps you understand and clear ARP Cache in Windows 11 and Windows 10.

Картинка с сайта: www.thewindowsclub.com

Why do you need to Clear the ARP Cache?

Similar to DNS Cache, ARP Cache can get stale. If the IP addresses of the connected devices on the network change, it may be difficult to find those devices. So, if the ARP Cache is stale or has been damaged, you need to fix it. One of the major downsides to clearing the ARP cache is that rebuilding it may result in errors.

To clear Address Resolution Protocol (ARP) Cache on your Windows computer, you can restart the Routing and Remote Services or use the Command Prompt with netsh Tool.

Since it’s an administrative task, the methods will need admin permission or a user account to fix it.

1] Routing and Remote Services

Картинка с сайта: www.thewindowsclub.com

• Press the Start button on the Keyboard and type Computer Management
• Once it appears on the list, click to open it
• Click on Services and Applications and then Services
• Locate the Routing and Remote Services and double-click to open it
• First, stop the service and then choose to disable it.
• Restart the PC, and come back to the same place, and enable it.

This process will clear all ARP or IP to MAC address mapping on the PC.

2] Command Prompt with netsh Tool

Картинка с сайта: www.thewindowsclub.com

netsh tool is a command-line utility that offers a direct option to delete the ARP cache. You can run this command on PowerShell or Windows Terminal, or Command Prompt with admin privileges.

• Use WIN + X to open the Power Menu.
• Select Windows Terminal (administrator) to launch it
• Type netsh interface IP delete arpcache and press the Enter key to execute the command.
• All you will get is an Ok in response.

You can also use the following command to display and clear the ARP cache

arp –a //to display the ARP cache

arp –d //to clear ARP cache

Finally, you can also choose to restart the PC if it helps.

I hope the post was easy to follow, and you now know how to clear the ARP Cache in Windows 11 and Windows 10.

Is it possible to Clear ARP Cache for particular IP

The arp -d command can do that, i.e., arp -d 192.168.100.1. It comes in very handy if a particular IP to MAC address fails, and you want to resolve it quickly.

How long does an ARP Entry last in Windows?

The typical timeout for ARP Cache is 10 to 20 minutes, but the cache is cleared automatically. A fresh mapping is required the next time the PC or any device requests that address.

What is ARP Protocol?

Address Resolution Protocol or APR takes data from IP addresses from the computer hardware, i.e., MAC address or Machine Address. Similar to how a website name is converted into an IP address, IP addresses are further converted to Machine Addresses.

What is an Incomplete ARP Entry?

This is for individual IP addresses. When checking on the ARP entries, if you notice incomplete next to an entry, the device has issued an ARP request but is yet to receive a response.

What problems can occur with ARP?

MAC addresses spoofing and communication delays. While the first happens when ARP is manually configured, the second is when there are multiple ARP broadcasts in a network.