see every device on your wifi with ARP

see every device on your wifi with arp

your laptop already knows more about your network than you think. it's been quietly keeping a little address book of every device it's talked to, and you can read that book with one command. no scanning tools, no sketchy downloads, just something built into your os already.

this is a good habit for anyone who uses public wifi, shares a home network with roommates, or just wants to know what's actually sitting on their lan. let's break it down.

the command

arp -a

arp stands for address resolution protocol. it's the thing that maps an ip address (like 192.168.1.14) to a physical mac address (like the actual network card baked into a device). every time your machine talks to another device on the local network, it has to resolve that device's mac address first, and it caches the result. arp -a just prints that cache.

run it on mac, linux, or windows and you'll get a list that looks something like this:

? (192.168.1.1) at a4:5e:60:c1:22:0f on en0
? (192.168.1.14) at 88:66:5a:12:9d:33 on en0
? (192.168.1.22) at 3c:22:fb:4a:11:87 on en0

each line is a device your machine has recently exchanged packets with. that's your router, your phone, your smart tv, that one printer nobody remembers plugging in, and possibly some stranger's laptop if you're on shared wifi.

why this matters on shared networks

here's the part people don't think about: on a normal home or cafe wifi, every device is on the same broadcast segment, which means every device can technically see every other device. it's not a hack, it's just how local networks work. arp is not a secret backdoor, it's the plumbing.

the catch is that arp itself has zero authentication built in. a device can lie about which mac address owns which ip, which is the basis of something called arp spoofing or arp poisoning. attackers use it to slide themselves between you and your router so they can watch or mess with your traffic. you don't need to learn how to do that to defend against it, you just need to know it exists and know how to spot when your own arp table looks wrong.

what to actually look for

run arp -a occasionally and get a feel for what's normal on your network. things that should make you pause:

duplicate ip addresses pointing to two different mac addresses. that's a classic sign of arp spoofing, since a legit device shouldn't be claiming two identities.

your router's ip suddenly mapping to a mac address you don't recognize. your router's mac doesn't change unless you replace the hardware, so if it shifts overnight, something is inserting itself into that spot.

a pile of unfamiliar devices on a network that should only have your own gear. on a home network this is easy to baseline. on public wifi it's basically the wild west, so don't expect a clean list there, just don't trust anything you see on it either.

how to defend your own setup

the fix isn't to stare at arp tables forever, it's to reduce how much you rely on trust at the network layer in the first place.

use a vpn on any network you don't fully control, cafes, airports, shared apartments with sketchy roommates. it encrypts your traffic so even if someone poisons the arp cache, they get nothing usable.

enable static arp entries or arp inspection on networks you manage, especially small business or homelab setups. most decent routers and managed switches support "dynamic arp inspection" or similar, which blocks devices from broadcasting fake ip-to-mac mappings.

segment your home network. put iot devices and guests on a separate vlan or guest wifi so a compromised smart bulb can't sit next to your work laptop on the same broadcast domain.

keep firmware updated on your router. a lot of these protections got added over the years and older firmware just doesn't have them.

the takeaway

arp -a takes two seconds to run and tells you exactly who your machine has been talking to on the local network. it won't catch everything, but it's a free, built-in way to sanity check your environment and notice when something doesn't add up. pair it with a vpn, network segmentation, and a router that isn't running firmware from 2016, and you've closed off one of the quieter ways local networks get abused.