ARP Discovery & Device Inventory: Why Visibility Beats Guesswork

Device discovery sounds trivial until you try to do it consistently. DHCP tables can be incomplete. Hostnames can be missing or misleading. Some devices randomize MAC addresses; others reuse generic ones. And many IoT endpoints are “quiet”—they do not advertise themselves like laptops do. In those conditions, ARP (Address Resolution Protocol) discovery becomes a practical tool because it is grounded in how IPv4 LANs work.

What ARP discovery is (in plain terms)

ARP is the protocol that maps IPv4 addresses to Ethernet (MAC) addresses on a local network. When a device wants to send an IP packet to another device on the same LAN, it must learn the destination MAC address. It asks: “Who has 192.168.1.20?” and the owner replies with its MAC. This is why ARP-level discovery is effective: it leverages the fundamental behavior of devices on a LAN.

In a scanning workflow, ARP discovery often means sending ARP requests across a subnet and collecting ARP replies. That quickly yields a list of active IPs and MAC addresses. It is fast and tends to find devices even when ICMP pings are blocked.

Why inventory is a security control (not just documentation)

Inventory is sometimes treated as “admin work,” but it is also a security control because it enables other controls:

• Access control: you can’t enforce who can connect if you can’t identify who is connected.
• Segmentation: you can’t place devices into the correct network segment without knowing what they are.
• Patch management: you can’t update firmware for devices you forgot you owned.
• Incident response: you can’t determine what changed if you don’t know what “normal” looked like.

In other words, inventory is the foundation layer. The value is not the list itself, but the fact that the list enables measurement.

A practical method to label devices

When WatchDog (or any scanner) discovers a device, you typically get an IP address and a MAC address. Sometimes you get a hostname. That’s enough to start, but labeling requires context. Use a simple schema:

• Owner: who is responsible for the device (you, family member, office owner).
• Role: what it does (camera, TV, phone, printer, smart speaker, NAS).
• Location: where it physically lives (living room, office, garage).
• Criticality: what breaks if it fails (high for safety devices; lower for entertainment devices).
• Trust tier: trusted LAN vs IoT segment vs guest.

The goal is to make the device list actionable. If you ever see a new MAC address in a scan, you should be able to say within minutes whether it belongs.

Handling common discovery edge cases

Real networks include complexity. Here are common edge cases and how to reason about them:

1) Devices that appear and disappear

Phones and laptops may sleep, roam between APs, or randomize MAC addresses. Treat these as “dynamic clients.” The control you want here is not a perfect always-on list, but a policy: guest devices belong to the guest network; known devices belong to known owners.

2) “Unknown vendor” MAC addresses

MAC-to-vendor lookups can be helpful, but they are not authoritative. Some vendors reuse chipsets; some MACs are randomized. When the vendor is unknown, use behavioral clues: what ports are open, what traffic patterns exist, and where did the device connect from?

3) Devices behind hubs or bridges

Some ecosystems route traffic through a hub, which may make downstream devices less visible at the IP layer. In those cases, the hub becomes a high-value device: it is a concentrator. Secure it carefully, keep it updated, and segment it appropriately.

Turning discovery into a repeatable operational loop

The best discovery workflow is repeatable and boring. It looks like this:

1. Run a discovery scan and export results.
2. Compare to last month’s baseline (new device? missing device? IP changes?).
3. For new devices, identify owner and role, then place into the correct segment.
4. For missing devices, verify whether it is offline or removed.
5. For changes in open ports, treat it as a configuration change that needs explanation.

Security benefits you get immediately

Even before you do any deep hardening, discovery yields immediate wins:

• Rogue device detection: you spot unknown devices quickly.
• Asset hygiene: you find old devices that should be decommissioned.
• Faster troubleshooting: you can tie problems to specific endpoints rather than guessing.
• Better segmentation: you can confidently move IoT devices to isolated networks.

WatchDog tie-in: When WatchDog performs ARP-level discovery, treat its output as your “source of truth” for the LAN. Export periodic reports and use them as an audit trail: what was present, when it changed, and how you responded.