PowerShell: Get ARP Table

Need to check the ARP table - to see which devices your machine has recently communicated with on the local network, or to troubleshoot a network connectivity issue? This one-liner pulls it straight from the system.

Prerequisites:

• Privileges: None
• Module: Built-in, no import needed

Quick Command:

Get-NetNeighbor -AddressFamily IPv4 | Where-Object { $_.State -eq "Reachable" -or $_.State -eq "Stale" } | Select-Object IPAddress, LinkLayerAddress, State

Example Output:

IPAddress   LinkLayerAddress  State
---------   ----------------  -----
10.211.55.1 00-1C-42-00-00-18 Reachable

How It Works:

• Get-NetNeighbor is the modern PowerShell replacement for the classic arp -a command - it returns every entry in the system's neighbor (ARP) table, mapping IP addresses to physical MAC addresses.
• By default this includes a lot of noise: multicast addresses, broadcast entries, and IPv6 link-local addresses that aren't useful for a typical lookup.
• -AddressFamily IPv4 filters down to only IPv4 entries.
• Where-Object { $_.State -eq "Reachable" -or $_.State -eq "Stale" } keeps only entries with an actual known device behind them - Reachable means it responded recently, Stale means it was reachable before but hasn't been reconfirmed. This filters out permanent/system entries like broadcast and multicast addresses.
• Select-Object IPAddress, LinkLayerAddress, State trims the output down to the IP, its corresponding MAC address, and connection state.

Pro Tip:

The classic arp -a command still works if you just want a quick, non-PowerShell-formatted view:

arp -a