How to View, Flush, and Manage the ARP Cache on Mac Using Terminal

Whenever a Mac communicates with other devices on a local area network (LAN)—such as network routers, network attached storage (NAS) devices, local printers, or development servers—it relies on the Address Resolution Protocol (ARP). ARP dynamically maps layer-3 Internet Protocol (IPv4) addresses to layer-2 physical Media Access Control (MAC) hardware addresses. To eliminate the overhead of broadcasting resolution requests for every single packet, macOS maintains a local, kernel-level ARP cache in system memory.

However, when network hardware changes occur—such as replacing a router, swapping a managed network switch, reassigning static IP addresses, or recovering from IP collision conflicts—the macOS ARP table can retain stale or conflicting hardware mappings. When this happens, Mac workstations encounter unexplained connectivity drops, “host unreachable” errors, or traffic misdirection. Using the native BSD arp command in Terminal, Mac administrators and power users can inspect active ARP entries, purge stale records, and configure static hardware mappings.

Understanding How the ARP Cache Works in macOS

When your Mac needs to send a packet to a local IP address (e.g., 192.168.1.1), the network stack checks its local ARP cache. If an entry exists, the packet is framed immediately with the destination MAC address and transmitted. If no entry exists, the Mac broadcasts an ARP request across the local subnet: “Who has IP 192.168.1.1? Tell 192.168.1.50.” The target device replies with its physical MAC address, and macOS stores the mapping in its kernel cache with an expiration timer (typically between 10 and 20 minutes).

If a network gateway is replaced while its IP address remains identical, the Mac continues attempting to deliver frames to the old MAC address until the cache record expires, causing local network communication to fail entirely.

Viewing the Complete ARP Cache in Terminal

To inspect all currently resolved IP-to-MAC address mappings on your Mac, open the Terminal application (located in /Applications/Utilities/Terminal.app) and execute:

arp -a

The command prints a formatted list of all discovered hosts across active network interfaces:

? (192.168.1.1) at 00:11:32:9c:4a:1b on en0 ifscope [ethernet]
? (192.168.1.120) at a4:83:e7:51:2b:04 on en0 ifscope [ethernet]
? (192.168.1.255) at ff:ff:ff:ff:ff:ff on en0 ifscope [ethernet]

Each line in the report reveals critical network details:

• IP Address: The IPv4 address of the resolved host in parentheses.
• MAC Address: The physical 48-bit hardware address (colon-separated hexadecimal bytes). A broadcast address displays as ff:ff:ff:ff:ff:ff.
• Network Interface: The network adapter managing the connection (e.g., en0 for Wi-Fi or primary Ethernet, en1 for secondary adapters).
• Scope Flags: ifscope indicates the entry is bound to a specific network interface; permanent indicates a manually defined static entry.

Querying a Specific Host or Gateway IP Address

If your local network contains dozens of active nodes, scrolling through the full table can be cumbersome. You can query a single target IP address directly:

arp 192.168.1.1

If the host exists in cache, arp outputs only that entry. If no record exists or the entry has expired, the command reports that the host could not be found.

Flushing and Clearing the Complete ARP Cache

To force macOS to discard all cached MAC address mappings and re-broadcast ARP discovery queries across the subnet immediately, flush the ARP cache. In macOS, clearing ARP records requires administrative privileges (sudo).

To purge the entire ARP cache across all network adapters, execute:

sudo arp -d -a

Terminal will display confirmation lines indicating that each individual IP address mapping has been unlinked from the kernel routing table:

192.168.1.1 (192.168.1.1) deleted
192.168.1.120 (192.168.1.120) deleted

Run arp -a immediately following the command to confirm that the resolution table is clear. The Mac will re-populate entries dynamically as outbound network traffic resumes.

Deleting a Single Stale ARP Entry

If you only need to resolve an issue with a single misbehaving host or replacement server without disrupting ongoing communication with other local devices, delete only that specific IP record:

sudo arp -d 192.168.1.150

Once deleted, initiate an active ping to force the network stack to broadcast a fresh ARP request:

ping -c 2 192.168.1.150

Creating a Static ARP Entry for High-Security Environments

In high-security networks or industrial environments vulnerable to ARP spoofing and man-in-the-middle attacks, administrators often configure static (permanent) ARP mappings for critical infrastructure, such as the default router gateway. A static entry prevents malicious actors from poisoning the Mac’s ARP table with rogue MAC addresses.

To bind an IP address permanently to a specific hardware MAC address, use the -s flag:

sudo arp -s 192.168.1.1 00:11:32:9c:4a:1b

Verify that the entry is marked with the permanent attribute:

arp 192.168.1.1

Static ARP entries persist in system memory until the Mac is restarted or the entry is explicitly removed with sudo arp -d 192.168.1.1.

By using the arp command in macOS Terminal, network engineers and administrators can rapidly diagnose local routing anomalies, eliminate stale gateway records after hardware upgrades, and secure local communications against ARP poisoning attacks.