MAC addresses, ARP, and private Wi-Fi addresses

Follow one packet across the LAN

Suppose a laptop sends traffic to a remote website. It chooses the appropriate IP route, then uses the next hop's local-link address to deliver the frame on Ethernet or Wi-Fi. Routers forward the IP traffic onward using a new link-layer frame for the next link.

For IPv4 on a local Ethernet network, ARP maps an IPv4 address to a link-layer address. IPv6 uses neighbor discovery instead. The local neighbor table is not a directory of every device on the Internet.

Inspect local neighbor information

# Windows: cached IPv4 ARP entries
arp -a

# Linux: neighbor table
ip neigh show

These commands show learned entries that may be incomplete, stale, or tied to particular interfaces. A missing entry does not prove that a device is absent. A router may appear as the next-hop neighbor for many remote IP destinations because those destinations are outside the local subnet.

MAC addresses are commonly written as six hexadecimal byte pairs. The displayed identifier may belong to a physical adapter, virtual adapter, or randomized Wi-Fi identity. Do not assume every prefix reliably identifies the device's manufacturer.

Why a Wi-Fi address changes

Modern devices can use a private address for a Wi-Fi network, and supported systems may rotate it according to their settings. This helps limit tracking across networks. The behavior depends on the device, OS version, and per-network configuration.

If a printer or laptop's reservation stops matching, check the router's actual lease identity and the device's private-address setting for that SSID. A changed MAC can create a new lease even though the user sees the same device name. Use the smallest documented adjustment needed for a trusted network rather than globally disabling privacy features.

Do not treat a MAC as a password

MAC filtering is not strong authentication: local identifiers can be observed and spoofed. Use supported Wi-Fi security, strong credentials, device updates, and appropriate guest isolation. A label in a router's client list is also not a definitive identity check.

When troubleshooting duplicate addresses, keep MAC, IP, interface, and timestamp together. An ARP entry changing between different interfaces may help reveal a conflict, but verify the actual device settings before drawing conclusions.

Remote websites typically see your routed public IP and application-level information, not the laptop's Ethernet MAC. Sharing a screenshot of your router's client list can still disclose local identifiers and device names, so redact details that are unrelated to the support question.