ARP (Address Resolution Protocol)

ARP (Address Resolution Protocol) finds the MAC address that belongs to an IP address on a local network. Frames on Ethernet and Wi-Fi are delivered by MAC address, so before a device can send to 192.168.1.20 it must know that machine's hardware address.

The device broadcasts "Who has 192.168.1.20?", and the owner replies with its MAC address. The answer is kept for a while in the ARP cache (arp -a shows it). Because ARP replies are not authenticated, attackers can send fake ones (ARP spoofing) to intercept traffic. IPv6 uses the Neighbor Discovery Protocol instead.