ARP cache
Table in the OS kernel that maps IPv4 → MAC. Populated by ARP requests (broadcasts) or static entries.
View: ip neigh show (Linux), arp -a (Windows/macOS). Entries become "STALE" after ~30s, "DELAY" then "FAILED" if not verified. Gateway MAC usually sticky-cached. Vulnerable to ARP spoofing — attacker gratuitous-ARPs with wrong MAC ⇒ MITM. Defences: Dynamic ARP Inspection (DAI) on switches, static ARP for gateway.