This read-only counter reports the number of ARP entries currently in an unresolved state, i.e. addresses the device is still trying to resolve to a MAC address. Admins watch it because a persistently high unresolved count can indicate hosts that are unreachable, misconfigured, or a sign of ARP-based scanning or an attack flooding incomplete entries. A count that spikes suddenly and doesn't clear would prompt an admin to check for unreachable subnets or suspicious ARP scanning activity.