ARP maps IPv4 → MAC inside one broadcast domain: request is a broadcast “who has 192.168.1.20?”, the reply is a unicast. Stateless, unauthenticated, and the first packet pays the cost — everything else hits the ARP cache (~4 h aging on Cisco).

The exam-grade details

• Routers ARP for the next-hop IP, never the final destination.
• A router has one ARP table per interface; ARP never crosses a router.
• ARP cache (IP→MAC, L3) vs CAM table (MAC→port, L2) — different tables, different boxes.

Gratuitous ARP

Sender IP = target IP: announces your own binding. Used for conflict detection at interface-up, and the secret sauce of FHRP failover — the new Active router sends a GARP so every cache updates to the virtual MAC immediately. Same mechanism makes ARP spoofing possible → Dynamic ARP Inspection is the counter.

show ip arp          clear ip arp
arp 192.168.1.50 0050.56AA.BBCC ARPA   ! static entry (rarely wise)

Reflex: no connectivity inside a subnet → check ARP before you check routing.