the Address Resolution Protocol

ARP is the little translator that turns an IP address into the MAC address needed to actually deliver a frame on the local network. A host knows the IP address it wants to reach, but Ethernet does not deliver by IP — it delivers by MAC. So before sending, the host must ask: which physical machine on this LAN owns that IP? ARP is the question-and-answer that finds out. It is like knowing someone's name (the IP) but needing their seat number (the MAC) to hand them a note.

The mechanism is a broadcast question and a unicast answer. To reach 192.168.1.20, a host broadcasts an ARP request to ff:ff:ff:ff:ff:ff: 'Who has 192.168.1.20? Tell me your MAC.' Every machine on the LAN receives it, but only the owner of that IP replies, unicast: 'I have 192.168.1.20, my MAC is de:ad:be:ef:00:14.' The asker caches that mapping in its ARP table for a few minutes so it does not have to ask again, then builds the Ethernet frame with that destination MAC. When the destination IP is on a different network, the host instead ARPs for its default gateway's IP and sends the frame to the router's MAC, which forwards onward.

ARP is essential glue between the IP layer and the Ethernet layer, and it normally just works invisibly. The honest caveat: classic ARP has no authentication at all — any machine can answer for any IP. An attacker can therefore send forged ARP replies (ARP spoofing / poisoning) to make victims send their traffic to the attacker, enabling a man-in-the-middle attack. ARP also works only within one LAN / broadcast domain; IPv6 replaces it with Neighbor Discovery, which uses ICMPv6 multicast instead of broadcast.