Read the ARP table without a command prompt
The ARP table is Windows' short list of which hardware address answers for each IP address on your local network. The usual way to see it is arp -a in a command prompt, which prints a column of numbers per interface with no hint of what each device is or whether anything looks wrong. Changing it means remembering netsh syntax, the exact adapter name and the dash-separated MAC format Windows insists on.
ARP Table Manager draws the same data as a switchboard. Each IP address is a jack on one side, each device a jack on the other, and each table entry is a patch cord joining them. Teal marks a dynamic entry Windows learned by itself, gold marks a pinned one, and red means look closer. Click any cord or row to see the device's name, its maker, the network it is on and whether it is answering.
It reloads on launch and then on the interval chosen under Read the table every, 10 seconds unless you change it. Reading it sends nothing onto the network; it is the list Windows already holds.
How to detect ARP spoofing on your network
ARP spoofing, also called ARP poisoning or ARP cache poisoning, is when a device on the same network replies to ARP requests with its own MAC address in place of the router's. Your PC then sends traffic to the impostor, which can read it and pass it on. On café, hotel or shared office Wi-Fi it is one of the oldest tricks there is.
With Warn about ARP spoofing switched on, the app looks for the two signs that give it away. If a second IP in the table reuses the gateway's MAC, that connection goes red with the label Answering with your router's physical address. And because the app remembers the router's MAC for each network, it warns The router's physical address changed if that ever shifts. Replaced the router yourself? Choose It's my new router and the new address is stored. Otherwise, Pin the old address puts the genuine router back in charge.
Add a static ARP entry in Windows
A static, or pinned, entry fixes an IP address to one physical address so Windows ignores anything the network claims about it. It is a common defense for the gateway, and a fix for printers and lab devices that answer ARP badly.
- Pull a line across the board between an IP and a device to pin that pairing directly, or choose Pin an address.
- Type the IP and the physical address. Colons, dashes or no separators all work, and the address is tidied and checked before anything is changed.
- Choose the Network the entry belongs to and select Pin.
- Approve the Windows permission prompt. If you decline it, nothing changes.
Clear an ARP cache entry you do not trust
Select an entry and choose Unplug to delete it, so Windows asks the network afresh next time. Unpin turns a pinned entry back into an ordinary one. Both use the built-in netsh tool behind a permission prompt; looking at the table needs no administrator rights at all.
For troubleshooting, Ping checks whether a device is replying and how quickly, right in the window. Copy address and Copy physical address put either value on the clipboard, and Export to CSV writes the whole table to a CSV file in Downloads. Turn off Show devices that have gone quiet to hide entries Windows is keeping for devices that have stopped answering.
