diff --git a/files/ansible-playbooks/sot-updater.yml b/files/ansible-playbooks/sot-updater.yml
index d4fb200..ae1141e 100644
--- a/files/ansible-playbooks/sot-updater.yml
+++ b/files/ansible-playbooks/sot-updater.yml
@@ -126,8 +126,19 @@
           - "Device: {{ inventory_hostname }}"
           - "Phase switch: Dev1 done → Dev2 (tunnel, auth, read indoor_fwver)"
 
-    - name: Refresh ARP 1 on DEV1’s LAN (send unsolicited ARP from temporary IP)
-      ansible.builtin.raw: arping -U -I eth0 192.168.1.11 -c 3
+    - name: Dev2 | ARP ping the target (from Dev1) to confirm who is at {{ dev2_host }}
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        arping -c 1 -w 2 -I {{ dev1_iface }} {{ dev2_host }} 2>&1 || true
+      register: dev2_arping
+      changed_when: false
+
+    - name: Debug | arping summary (MAC & replies)
+      debug:
+        msg:
+          - "arping rc={{ dev2_arping.rc }}"
+          - "arping stdout={{ (dev2_arping.stdout | default('')) | trim }}"
+          - "arping stderr={{ (dev2_arping.stderr | default('')) | trim }}"
 
     # ───────────────────────── TUNNEL PREP ─────────────────────────
     - name: Add temporary IP on DEV1 (tolerate 'File exists')
@@ -202,8 +213,19 @@
           - "_ctrl_dir={{ _ctrl_dir }}"
           - "_ctrl_sock={{ _ctrl_sock }}"
 
-    - name: Refresh ARP 1 on DEV1’s LAN (send unsolicited ARP from temporary IP)
-      ansible.builtin.raw: arping -U -I eth0 192.168.1.11 -c 3
+    - name: Dev2 | ARP ping the target (from Dev1) to confirm who is at {{ dev2_host }}
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        arping -c 1 -w 2 -I {{ dev1_iface }} {{ dev2_host }} 2>&1 || true
+      register: dev2_arping
+      changed_when: false
+
+    - name: Debug | arping summary (MAC & replies)
+      debug:
+        msg:
+          - "arping rc={{ dev2_arping.rc }}"
+          - "arping stdout={{ (dev2_arping.stdout | default('')) | trim }}"
+          - "arping stderr={{ (dev2_arping.stderr | default('')) | trim }}"
 
     - name: Start SSH ControlMaster and forward 127.0.0.1:local → DEV2:22 via DEV1
       delegate_to: localhost
@@ -229,6 +251,8 @@
           - "Started ControlMaster tunnel (rc={{ start_tunnel.rc | default('n/a') }})"
           - "stdout={{ (start_tunnel.stdout | default('')) | trim }}"
           - "stderr={{ (start_tunnel.stderr | default('')) | trim }}"
+    
+
 
     - name: Probe TCP reachability to DEV2 through the tunnel
       delegate_to: localhost
@@ -255,8 +279,19 @@
           - "Device: {{ inventory_hostname }}"
           - "Phase: Dev2 (auth selection, firmux/banner read)"
 
-    - name: Refresh ARP 1 on DEV1’s LAN (send unsolicited ARP from temporary IP)
-      ansible.builtin.raw: arping -U -I eth0 192.168.1.11 -c 3
+    - name: Dev2 | ARP ping the target (from Dev1) to confirm who is at {{ dev2_host }}
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        arping -c 1 -w 2 -I {{ dev1_iface }} {{ dev2_host }} 2>&1 || true
+      register: dev2_arping
+      changed_when: false
+
+    - name: Debug | arping summary (MAC & replies)
+      debug:
+        msg:
+          - "arping rc={{ dev2_arping.rc }}"
+          - "arping stdout={{ (dev2_arping.stdout | default('')) | trim }}"
+          - "arping stderr={{ (dev2_arping.stderr | default('')) | trim }}"
 
     # ───────────────────────── DEV2 AUTH PICK (as per update-indoor) ─────────────────────────
     - name: Try DEV2 login with 'basicpass' (root)
@@ -326,8 +361,19 @@
       debug:
         msg: "DEV2 passfile used: {{ dev2_passfile_used }}"
 
-    - name: Refresh ARP 1 on DEV1’s LAN (send unsolicited ARP from temporary IP)
-      ansible.builtin.raw: arping -U -I eth0 192.168.1.11 -c 3
+    - name: Dev2 | ARP ping the target (from Dev1) to confirm who is at {{ dev2_host }}
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        arping -c 1 -w 2 -I {{ dev1_iface }} {{ dev2_host }} 2>&1 || true
+      register: dev2_arping
+      changed_when: false
+
+    - name: Debug | arping summary (MAC & replies)
+      debug:
+        msg:
+          - "arping rc={{ dev2_arping.rc }}"
+          - "arping stdout={{ (dev2_arping.stdout | default('')) | trim }}"
+          - "arping stderr={{ (dev2_arping.stderr | default('')) | trim }}"
 
     # ───────────────────────── DEV2 READS ─────────────────────────
     - name: Dev2 | Read /usr/lib/release/firmux (if present)