How to Configure Static ARP and Neighbor Cache Bindings in Windows 11 Using PowerShell

Maintaining security and deterministic routing across enterprise Windows environments often requires administrators to enforce static physical-to-logical address bindings. On local IPv4 subnets, network hosts resolve IP addresses to physical Layer 2 Media Access Control (MAC) addresses using the Address Resolution Protocol (ARP). In IPv6 networks, the equivalent discovery mechanism is handled by Neighbor Discovery Protocol (NDP) Neighbor Solicitation and Advertisement messages.

Because dynamic ARP and NDP caches automatically update based on unsolicited broadcast responses, networks without hardware port security are vulnerable to ARP cache poisoning, man-in-the-middle (MITM) spoofing, and router gateway hijacking. By binding critical network assets—such as the default gateway router, local DNS resolvers, or domain controllers—as static entries in the Windows neighbor cache, system administrators ensure communication paths cannot be poisoned. Windows 11 includes the New-NetNeighbor PowerShell cmdlet to manage static ARP and neighbor bindings cleanly. This guide shows how to configure static ARP and neighbor cache bindings in Windows 11 using PowerShell.

Understanding Dynamic vs Static Neighbor Entries

The Windows TCP/IP stack (tcpip.sys) manages physical Layer 2 addresses through the unified Neighbor Cache:

• Dynamic Entries: Resolved dynamically through standard ARP or NDP discovery queries. Dynamic entries have an automatic timeout and can be modified or overwritten by incoming network advertisements.
• Static Entries: Manually configured by an administrator. Static entries do not time out, persist across standard network interface flushes, and ignore conflicting ARP reply packets from the network, preventing ARP cache poisoning attacks.

Identifying the Network Interface and Gateway MAC Address

Before adding a static entry, you must identify your active network interface alias (or index) and the exact MAC address of the target host or default gateway router.

Step 1: Find the Active Interface Index and Name

1. Right-click the Start button on Windows 11 and select Terminal (Admin) or PowerShell (Admin).
2. Query your active network adapters:

Get-NetIPInterface -ConnectionState Connected | Select-Object InterfaceAlias, InterfaceIndex, AddressFamily

Note your primary network adapter’s InterfaceAlias (e.g. "Ethernet" or "Wi-Fi") or InterfaceIndex (e.g. 12).

Step 2: Retrieve the Current Gateway MAC Address

To inspect your current default gateway IP and dynamic MAC address:

1. Find your default gateway IP address:

(Get-NetRoute -DestinationPrefix "0.0.0.0/0").NextHop

2. Query the dynamic neighbor cache for that IP address (e.g. 192.168.1.1):

Get-NetNeighbor -IPAddress "192.168.1.1" | Select-Object IPAddress, LinkLayerAddress, State, InterfaceAlias

Copy the returned LinkLayerAddress (for example, "00-1A-2B-3C-4D-5E").

Creating a Static Neighbor Binding with New-NetNeighbor

Use the New-NetNeighbor cmdlet to create a permanent, static binding in the neighbor cache.

Configuring a Static IPv4 ARP Binding

Execute the following command, specifying the interface alias, target IP, MAC address, and state:

New-NetNeighbor -InterfaceAlias "Ethernet" -IPAddress "192.168.1.1" -LinkLayerAddress "00-1A-2B-3C-4D-5E" -State Permanent

The -State Permanent parameter ensures that the entry is marked as static and remains impervious to incoming ARP cache poisoning packets.

Configuring a Static IPv6 Neighbor Binding

The same cmdlet syntax applies to IPv6 router advertisements and link-local gateways:

New-NetNeighbor -InterfaceAlias "Ethernet" -IPAddress "fe80::1" -LinkLayerAddress "00-1A-2B-3C-4D-5E" -State Permanent

Verifying the Static Binding in the Neighbor Cache

Verify that the newly created binding is actively enforced by querying Get-NetNeighbor:

Get-NetNeighbor -InterfaceAlias "Ethernet" -IPAddress "192.168.1.1" | Format-Table IPAddress, LinkLayerAddress, State, AddressFamily

Confirm that the State column displays Permanent rather than Reachable, Stale, or Incomplete.

Modifying or Removing Static Neighbor Entries

If physical network equipment is replaced (e.g. a new router is installed with a different MAC address), you must update or remove the static binding.

Updating an Existing Static MAC Address

Use Set-NetNeighbor to update the hardware address:

Set-NetNeighbor -InterfaceAlias "Ethernet" -IPAddress "192.168.1.1" -LinkLayerAddress "00-50-56-AA-BB-CC"

Deleting a Static Binding

To remove the static entry and restore standard dynamic ARP/NDP resolution, use Remove-NetNeighbor:

Remove-NetNeighbor -InterfaceAlias "Ethernet" -IPAddress "192.168.1.1" -Confirm:$false

Administrative Security and Operational Best Practices

• Elevated Privileges Required: Adding, modifying, or removing neighbor entries directly alters the kernel TCP/IP routing state and requires an elevated PowerShell session with local administrator rights.
• Persistence Across Reboots: Entries created with -State Permanent persist in the active network stack session. To ensure static bindings survive system reboots across dynamic DHCP environments, deploy the PowerShell commands via a computer startup script or Microsoft Intune PowerShell script policy.
• Hardware Replacement Verification: If a router or firewall is swapped on a subnet where static ARP bindings are enforced, connected workstations will lose network connectivity until the static MAC entries are updated with the replacement hardware’s address.