ARP and MAC addresses — layer 2, the vendor tell, and stale neighbours

An ARP entry proves a device is on your physical LAN. No entry means it's elsewhere — a VLAN, a VPN, another subnet — or asleep.

What it is. On a LAN, packets are delivered by MAC address (aa:bb:cc:dd:ee:ff), not IP. ARP (IPv4) and Neighbor Discovery (IPv6) ask "who has 192.168.1.50?" and cache the answer for a few minutes. That cache is the *neighbour table*: arp -a on Windows/macOS, ip neigh on Linux.

The vendor tell. The first three bytes of a MAC (the OUI) identify the manufacturer. n check and n scan print it — it's how you tell the Raspberry Pi from the smart plug from the phone.

What the line means

• MAC found — the device answered on this physical segment. Layer 2 works; anything failing above is IP, firewall or service.
• No ARP entry — the device is not answering on this segment. Either it's on another subnet or VLAN (you'd reach it via a router, and the MAC you'd see is the router's), or you're reaching it through a VPN, or it's asleep/off, or it simply hasn't been talked to lately (the cache expires).

Stale ARP

After a device changes IP (DHCP shuffle, a swap of two machines), a neighbour entry can point the *old* IP at the *old* MAC for a couple of minutes: packets go to the wrong box and vanish. Symptoms: "it pings intermittently" right after a change. Flush: arp -d * (Windows, admin), sudo ip neigh flush all (Linux), sudo arp -a -d (macOS) — n flush . does it with a warning.