I don't know what a ‘routing table’ is in this context because this is all a single lan, there is bridging here but no routing, correct? Please do forgive me if you know all this already, you probably do. A routing table is a an L3 thing (ie IPv4 and IPv6) list of IP address prefixes ie IP address ranges versus what to do with them. The kind of thing you often do see though is either or both of:
- a dhcp allocation table - listing which IPv4 addresses have been handed out to the various devices by the DHCP server, this is a map between IP addresses and MAC addresses and vice versa
- an arp cache listing, lists every known MAC address to IPv4 or IPv6 pairing that has been learned. This will list everything that a particular machine knows of, including devices that do not use DHCP
Sometimes things can sit in the ARP cache listing for an enormous amount of time. Devices may have a timeout after which they re-query the MAC address for a particular IP address by sending out a new probe in case an IP address has become associated with something with a different MAC address for some strange reason.
I don't know that that will help much. I rather doubt you have a security issue somehow. Maybe just a quirk of the UI of some kit somewhere.
I must say that I have failed to understand the lifetimes of some of this kind of listed info.
Sincere apologies if telling you a heap of stuff you already know.
As for checking whether a device is really there, it is worth forcibly clearing your own ARP cache out, different o/s have different commands for this, and then re-pinging the node you wish to check on. There really ought to be a tool that pings some node
by MAC address, that would be very useful.
On some operating systems, the ARP cache gets binned if you bring an interface down and up again, such as unplugging a NIC or switching a NIC off then on. But I wouldn't guarantee it, would need to test this theory on your system.
[Moderator edited to fix a typo.]