Before sending an Ethernet frame to a local destination or next-hop router, a host can broadcast an ARP request; the device claiming the target address replies with its hardware address.
Hosts keep learned mappings in an ARP cache so they do not need to broadcast for every packet. ARP operates only on the local link: a sender reaching a remote network resolves the local router’s address, not the remote host’s address. IPv6 does not use ARP; its Neighbor Discovery mechanisms perform related functions using ICMPv6.
Key points
Request and replyA request asks which link-layer address owns a target protocol address, and a reply supplies a mapping that hosts may cache.
Local scopeRouters do not normally forward ARP broadcasts, so each broadcast domain performs its own resolution.
Defensive controlsSegmentation, controlled switch features, static mappings for limited critical cases, monitoring, and strong admission controls can reduce exposure to forged mappings.
Important limitationARP does not authenticate its mappings. A device on the local network may send forged or misleading ARP messages, enabling traffic interception, redirection, or disruption; protections depend on the surrounding network design and enforcement, not on ARP’s age alone.