How to Query and Manage the ARP and Neighbour Cache in Windows 11 Using PowerShell

When communicating with devices on a local subnet, Windows 11 relies on hardware address resolution to map Layer 3 IP addresses to physical Layer 2 MAC (Media Access Control) addresses. For IPv4 traffic, this mapping is established via the Address Resolution Protocol (ARP), while IPv6 networks utilise Neighbour Discovery Protocol (NDP). In previous versions of Windows, administrators relied on legacy command-line tools such as arp -a and netsh. However, these tools return unstructured text that cannot be easily queried, filtered, or scripted in modern environments.

In Windows 11, the native NetTCPIP PowerShell module provides robust, object-oriented cmdlets to inspect, configure, and purge the combined IPv4 and IPv6 neighbour cache. With Get-NetNeighbor, New-NetNeighbor, and Remove-NetNeighbor, system administrators can rapidly audit hardware resolution tables, bind static MAC assignments for sensitive network equipment, and flush poisoned or stale cache records. In this tutorial, you will master the administration of the neighbour cache in Windows 11 using PowerShell.

Understanding the Windows Neighbour Cache Architecture

The Windows TCP/IP stack maintains an in-memory database of every local host with which it has recently exchanged network packets. Unlike the archaic arp.exe command, which is strictly limited to IPv4, the modern PowerShell neighbour cache encompasses both address families and reports detailed operational states:

• Reachable: The neighbour host has responded recently and is confirmed to be operational.
• Stale: The reachability timer has elapsed; the entry remains valid for transmission, but the kernel will re-verify reachability before sending subsequent traffic.
• Delay / Probe: The host is currently transmitting ARP requests or ICMPv6 Neighbour Solicitations to verify whether the peer is still reachable at that hardware address.
• Permanent: A static mapping manually bound by an administrator. Permanent entries do not expire and cannot be overwritten by dynamic ARP responses.
• Unreachable: Address resolution failed; no physical device responded to queries for that IP address.

Step 1: Open an Elevated PowerShell Console

While querying the cache can be performed in standard user mode, modifying entries or flushing the cache requires administrative privileges. Press Windows Key + X and select Terminal (Admin) or PowerShell (Admin).

Step 2: Querying the Complete Neighbour Cache

To inspect every IP-to-MAC resolution entry registered in Windows 11, execute:

Get-NetNeighbor

To format the output into a structured, readable table highlighting interface aliases, IP addresses, Link-Layer (MAC) addresses, and current states, pipe the command to Select-Object and Format-Table:

Get-NetNeighbor | Select-Object InterfaceAlias, IPAddress, LinkLayerAddress, State, AddressFamily | Format-Table -AutoSize

Step 3: Filtering Neighbour Entries by Protocol and Interface

In networks with numerous virtual switches, VPN adapters, and dual-stack IPv4/IPv6 configurations, filtering the output accelerates troubleshooting:

Filtering Exclusively for IPv4 ARP Entries:

Get-NetNeighbor -AddressFamily IPv4 | Format-Table IPAddress, LinkLayerAddress, State, InterfaceAlias -AutoSize

Filtering for Active IPv6 Neighbour Discovery Entries:

Get-NetNeighbor -AddressFamily IPv6 | Where-Object { $_.State -eq "Reachable" } | Format-Table IPAddress, LinkLayerAddress, State -AutoSize

Targeting a Specific Network Adapter:

If you want to view entries associated exclusively with your primary Wi-Fi or Ethernet connection, specify the InterfaceAlias:

Get-NetNeighbor -InterfaceAlias "Ethernet"

Step 4: Adding a Static (Permanent) ARP / MAC Address Mapping

In secure networks or industrial control setups, administrators frequently configure static ARP entries to prevent ARP spoofing, avoid gateway redirection attacks, or maintain communication with legacy devices that do not respond consistently to dynamic broadcast queries.

To bind a static MAC address (e.g. 00-11-22-33-44-55) to a specific IP address (e.g. 192.168.1.50) on the “Ethernet” adapter:

New-NetNeighbor -InterfaceAlias "Ethernet" -IPAddress "192.168.1.50" -LinkLayerAddress "00-11-22-33-44-55" -State Permanent

Verify that the entry was registered as a permanent mapping:

Get-NetNeighbor -InterfaceAlias "Ethernet" -IPAddress "192.168.1.50"

The returned record will confirm State : Permanent, ensuring the Windows kernel will never overwrite or time out this resolution.

Step 5: Removing or Flushing Neighbour Cache Entries

When replacing a network router, migrating servers to new virtual host hardware, or resolving IP address conflicts, the Windows cache may retain old MAC addresses, preventing outbound traffic from reaching the new hardware.

Flushing a Single Stale IP Entry:

To purge resolution for a specific target host:

Remove-NetNeighbor -InterfaceAlias "Ethernet" -IPAddress "192.168.1.50" -Confirm:$false

Purging All Dynamic Neighbour Entries on an Interface:

To wipe the entire dynamic ARP and neighbour cache for a specific network adapter without removing static entries:

Remove-NetNeighbor -InterfaceAlias "Ethernet" -Confirm:$false

Flushing the Entire System-Wide Neighbour Cache:

To completely purge all entries across all adapters and force Windows 11 to re-resolve every device on the network:

Get-NetNeighbor | Remove-NetNeighbor -Confirm:$false

Immediately after running this command, Windows will broadcast fresh ARP requests and NDP solicitations as soon as applications transmit packets.

Exporting Neighbour Cache Audits to CSV

Network security audits often require capturing point-in-time snapshots of connected local network peers. You can export the active neighbour cache to a formatted CSV spreadsheet:

Get-NetNeighbor | Select-Object InterfaceAlias, InterfaceIndex, IPAddress, LinkLayerAddress, State, AddressFamily | Export-Csv -Path "$HOME\Desktop\Neighbor_Cache_Audit.csv" -NoTypeInformation

Troubleshooting Common Neighbour Cache Issues

• Access Denied Errors: Executing New-NetNeighbor or Remove-NetNeighbor without administrative elevation will trigger “Access is denied” errors. Ensure PowerShell is running as an Administrator.
• Duplicate MAC Addresses (ARP Spoofing / IP Conflicts): If multiple different IP addresses in your Get-NetNeighbor output share the exact same LinkLayerAddress (and they are not virtual IPs on a cluster or router HSRP/VRRP address), a rogue device or accidental duplicate IP configuration may be disrupting subnet traffic.
• Static Entries Disappearing After Reboot: Permanent entries created with New-NetNeighbor persist through standard user logoffs but may clear upon a full system reboot depending on driver reload policies. To make static mappings permanent across reboots, add the New-NetNeighbor command to a startup script executed via Windows Task Scheduler.

Frequently Asked Questions

Does Remove-NetNeighbor also flush the Windows DNS cache?

No. Remove-NetNeighbor clears the Layer 2 hardware address (MAC) resolution table. To flush the Domain Name System (DNS) hostname cache, use the companion cmdlet Clear-DnsClientCache.

Can I use Get-NetNeighbor to discover devices on another subnet?

No. The neighbour cache only records devices that reside on the same local Layer 2 broadcast domain (subnet). Traffic destined for remote subnets or public internet sites will resolve to the MAC address of your default local gateway.

What does a LinkLayerAddress of 00-00-00-00-00-00 indicate?

A zeroed MAC address typically indicates an incomplete resolution state where the local host transmitted an ARP request or Neighbour Solicitation, but no physical device has yet answered.

Is Get-NetNeighbor faster than running the legacy arp -a command?

Yes. Get-NetNeighbor communicates directly with the Windows TCP/IP kernel driver via WMI/CIM, returning strongly typed .NET objects that can be immediately filtered and processed in automation scripts without requiring regex text parsing.