ARP

Address Resolution Protocol operates at the boundary between Layer 3 (network) and Layer 2 (data link). When a host sends a packet to an IP on the same subnet, it broadcasts an ARP request asking “who has this IP?” The owner replies with its MAC address, and the sender caches the mapping in its ARP table. A key exam nuance is Proxy ARP: a router responds to ARP requests on behalf of hosts on a different subnet, making remote hosts appear local. Gratuitous ARP — a device announcing its own IP-to-MAC mapping unprompted — is used after IP changes but is also exploited in ARP spoofing/poisoning attacks to redirect traffic.