What does ARP mean? That night, the NAS was on and off, arp -a checked and saw two devices competing for the same IP

last month after helping my cousin fix the SMB issue Windows couldn't connect to the NAS his second-hand four-port Synology unit was settled for a short time. Last weekend at 11 p.m., he called again, but this time the symptoms were different: it wasn't that he couldn't connect, but rather 'Schrödinger's can't be reached'—ping 192.168.0.30, three of the first four packets returned, the last four were all lost, and after ten seconds, ping again worked. The file freezes halfway through, and after a while, it resumes itself.

even more strange was the screenshot he sent: a warning popped up in the upper right corner of Synology's backend, "Network IP conflict detected." These eight words define the direction of solving the case. I had him type arp -a twice and gave me two outputs, and I immediately noticed the problem: the same 192.168.0.30 records have different MAC addresses. At some point, a new device appeared at home, competing with NAS for the same house number.

article will clarify the ARP story behind this matter. It's the most fundamental link in the network. Previously, when you wrote MAC address or subnet mask, you always avoided it. This time, it's written directly—because of IP conflicts, intermittent connections, and lost contact after switching devices, the root of the problem is almost always with it.

to be clear: ARP is the same call to trade IP for MAC

continued with the analogy from the neighborhood in the cover-up article. The mask circles your neighborhood (network segment), gateway is the main gate of the community, and finding people inside the community relies on "shouting out."

scenario looks like this: your computer needs to send data to 192.168.0.30. The IP address is the house number used by the user, but when packages are actually packaged and shipped online, the envelope is written as the MAC address—the physical number of the device's network card. Here's the problem: the computer only knows the house number, not the person living under it.

ARP (Address Resolution Protocol) is responsible for this translation task. The computer first broadcasts loudly in the neighborhood: "Who is 192.168.0.30?" Please reply!" This voice was heard by every device in the entire community. The address was really my device's response: "I am 192.168.0.30, and my MAC is 00-11-32-xx." Back and forth, the computer records this correspondence in a notebook, and the next email is sent using the MAC. After a while, you don't need to re-send the message.

that little notebook is ARP cache table . This is the most thought-provoking aspect of the ARP protocol: shouting (broadcasting) is very loud, and the whole community has to stop their work and listen to your shouting, so the protocol is designed to "remember every shout, and avoid shouting if possible." Why did the IP conflicts later manifest as intermittent connections? The mystery lies in the refresh mechanism of this table. Read on.

The night

cousin's house: two ARP -A, MAC switched right under his nose

returned to the crime scene. My cousin's NAS was manually set to fixed IP 192.168.0.30 according to the tutorial when installing, which was entered in the settings panel, but the router was completely unaware of the setup. Not long ago, he replaced the TV with a new box, plugged in the network cable, and DHCP automatically took the address—the router saw the address pool was empty at .30 (it really didn't know NAS had manually occupied it), so he generously handed it over to the box.

two households lived under the same house number. When the computer called "Who is .30", both the NAS and the box responded; the computer's notebook alternated between the NAS MAC and the box MAC. When sending documents, the MAC on the envelope points to the NAS, ensuring smooth data delivery; The next stopwatch was knocked out by the box's response. The envelope pointed to the box, and when the box saw it wasn't the recipient, it threw it away. This is the whole mechanism behind "intermittent connection"—it's not a line failure, but the recipient switching recipients.

verification method is the two steps I asked him to do. First time:

arp -a
Interfaces: 192.168.0.108 --- 0x5
192.168.0.30 00-11-32-6a-4c-21 Dynamic
192.168.0.1 d8-5d-84-3f-90-77    dynamic

typing again every ten seconds, the .30 line becomes another MAC starting with 50-e2-f5. 00-11-32 is the prefix of the Synology network card manufacturer; 50-e2 is from that box. MAC changes its owner every ten seconds, more straightforward than any troubleshooting. By the way, pay attention to the MAC corresponding to .1 on the router's line, as it is used to check for network scraping and ARP spoofing.

handle it in three steps: first disconnect the box from power or internet, and the NAS will immediately stabilize; Then go to the router's backend and draw .30 to create a DHCP address pool, or simply make static binding to both the NAS and the box— article on static IP binding wrote the full method, and the core is simple: the manually set IP must be known to the router. Either fill it outside the pool or bind it directly on the router side, so DHCP doesn't have a chance to separate it. Later, my cousin tied a .30 speed to the NAS in the router, changed the box to DHCP to automatically take it, and things have been fine since then. This also explains why DHCP address pools are often advised to leave a segment unused—to make room for manual devices.

How to read the output of

arp -a: Each column has its own use

Windows arp -a is the current ARP table for the local machine. All three fields are worth recognizing:

Don't ignore the

interface line—it tells you which network card the meter is attached to. After installing a virtual machine or VPN, several virtual network cards will appear, each with its own independent ARP table. If you misread the interface, it might misjudge that "the other party is not in the table"—which is basically a mistake in the small notebook.

Mac commands differ from those on Linux, but the same thing: Mac uses arp-a, Linux can ip neigh, and output includes IP, MAC, and status. If you see FAILED or INCOMPLETE hanging in the status bar, it means no one responds to the call—the other party has shut down their phone or is not in this segment at all.

clears the cache with arp -d, then delete the single entry from the IP and clear everything with the asterisk. On Windows, this command requires administrator privileges to enable cmd; normal permissions will deny access. When should manual cleaning be needed? After changing the network card or relocating the network port, some machines still can't connect. First, ipconfig/flushdns clear the domain cache, then arp -d * to clear the system and let the computer call each one again. Many "metaphysical disconnections" heal themselves at this stage.

Windows the "IP address conflict" is the free ARP triggering the alarm

the alert Synology popped up in my cousin's screenshot is backed by a mechanism called "Free ARP," and Windows' "IP address conflict detected" popup is also based on this.

a device is configured with an IP and ready to go online, it first asks and answers: "Who is 192.168.0.30?" —The key point is, it itself is 192.168.0.30. Normally, no one would respond to this strange call, so it could go online with peace of mind. But if the address is already taken by someone else, the person holding it sees "This is my address, who is asking?" and replies "I am," the new device immediately realizes the number collision, Windows immediately triggers a conflict warning, and Synology sends an alarm in the background—all in those moments.

this self-questioning and answering has a side benefit: when the whole community hears it, they update the record in the notebook to the caller's new MAC. So when you change routers or devices and network cards, you usually don't need to clear caches on each machine. Once a new device goes online, everyone will refresh their tables after a round of broadcasts. What really couldn't be refreshed was my cousin's tug-of-war—'both devices declaring the same IP as free ARP'—you swipe it once, I refresh it again, so the ARP meter kept changing that night.

When will

proactively clash numbers? The three most common are: manually setting the IP into the DHCP pool (cousin's model); Both devices manually set the same IP; After the router powered off and restarted, the DHCP record was lost, and the active address was re-relocated. The first two are setup issues, and the third happens occasionally on old routers— restarting the router at a time. The article mentioned losing status during power outages Address allocation records are one of the lost items, and static binding of important devices can avoid most of it.

the IP/MAC binding in the router is part of the ARP family

the router's backend reveals a feature called "IP and MAC binding," or "static ARP" or "ARP binding." The names vary widely, but essentially, they all focus on the router's ARP table.

router maintains an ARP sheet — the backend device list contains "device name + IP + MAC," largely based on the learning results of this table. Every connected device has called or responded to calls, all recorded, then cross-checked with DHCP's lease records, forming the list you see. Some older routers don't display device names in the background, only a MAC string, which is the most original version of the table.

"Binding" means picking a few records and pinning them down. After being pinned, there are two uses: the first layer is fixed IP allocation (DHCP static lease), so addresses no longer drift, port forwarding and remote access point to fixed addresses for food, and the IP drift rule is completely nullified; The other layer is security: after binding the gateway record, someone in the LAN forges the gateway MAC to send fake responses (the old ARP deception trick), and the router doesn't acknowledge it. The first layer of home scenarios is for first-time buyers, while the second layer is just icing on the cake.

has a rare reverse usage: when device is turned off, it does not respond to ARP . I once fell into this trap when writing about remote boot —the router tried to transfer the magic packet coming in to the home computer, but when checking the ARP table, it found the computer's records had long expired. No one answered when I called out, so the packet was thrown away when it reached the door. Therefore, one of the prerequisites for remote booting is to bind the computer's IP/MAC to the router so that this record remains permanently in the table. You see, with the same mechanic, using it correctly prevents drift, and using it against it protects the record.

should be suspected of ARP

ARP causes several fixed causes; if you encounter them, take them personally:

the troubleshooting sequence is as follows: first ping to clear the connection, then arp -a to check the meter, then to use arp -d to clear and retry, and finally it's time to restart the device. Most "mystical network problems" become apparent within the first three steps; reboots are both a big move and a lazy move—they do clear the ARP table along the way, so the "restart and it's fine" problem mostly lies in this chart, but restarting will never tell you why.

cousin's NAS is now very stable. He later told me the truth: I used to think the internet was either connected or blocked, black and white. After all the trouble that night, I realized there was a "switching" zone in between, and that area was basically managed by ARP.