In reply to a post by Ancient_Mariner:

Thank you for the reference to my Draytek. The DHCP Table has the information I wished for. Strangely(?) the ARP Cache Table offers two less than the DHCP Table.

The expiry time for these two items will be different. Often you can configure DHCP to remember MAC to IP mappings as you desire, for example upto 28 days if you have enough IP addresses.

ARP will expire much more often but is recreated. Not worth worrying about. ARP is so much more low level.

Thanks for that. Advanced IP Scanner looks interesting. I particularly like the display of the manufacturer's name. Certainly helps tracking down what's what.

Cheers!

In reply to a post by Ancient_Mariner:

Thanks for that. Advanced IP Scanner looks interesting. I particularly like the display of the manufacturer's name. Certainly helps tracking down what's what.

This is called OUI lookup as the IEEE allocate the first block of numbers in each MAC to a vendor as an "organisationally unique identifier". https://standards.ieee.org/faqs/regauth.html#17

However often you find the manufacturer of the network card (e.g. Intel, Broadcom, Realtek) rather than the manufacturer of the device (e.g. Apple, Dell, HP, Samsung, LG etc).

The larger makes tend to have their own OUI's added to the network card, typically Apple, Dell etc do this, the volumes are so high.

There are other places to look up OUI's too:
https://standards.ieee.org/faqs/regauth.html
https://www.wireshark.org/tools/oui-lookup.html

Yes. That’s normal. As jchamier had pointed out, the ARP table is effectively an instant (not quite) snapshot of what the particular network router (or switch) has mapped between the MAC address and IP address. Hence the description of it being a “cache” - temporal in nature.

On the other hand DHCP table is a record of active “leases” and these are active for the life time of the lease; which could be in the minutes, hours, days or longer! Even if the device has now disconnected or powered off from the network in question it’s lease will still be evident in such a table held by the DHCP server until the lease expires (or is otherwise cleared).

An ARP cache will also show devices that have not necessarily been assigned an IP address by DHCP - could be manually assigned - and may include devices that are indirectly connected via intermediate hubs or switches. It’s what the router or switch can ‘see’ on the broadcast domain of the device.

Note also the same device if connected by say WiFi and LAN cable will have a listing in the respective table for each respective interface/MAC address. In the case of a laptop for example both interfaces could be simultaneously active.

Edited by Pheasant (Sun 06-Jun-21 14:24:47)

Fing make a pretty decent desktop and mobile app which will give you quite comprehensive information about your network.

https://www.fing.com/products/fing-desktop

They do try to upsell their premium products but it's not too intrusive.

A nice one is WiFiman from Ubiquiti for a mobile device. Has a WiFi scanner, speed test and device discovery with no ads. It also has a signal mapper, though I have never used that facility.

As someone else pointed out you have a Draytek router, you can assign a static IP to devices you need to be on IP address that don't change. Personally I use and abuse dnsmasq in my Edgerouter so I can assign them DNS names. Although mDNS is an alternative option there but I am old school and prefer proper DNS.