ARP
acronymnetworking
Address Resolution Protocol: how a host asks 'who has this IP?' on the local network and learns the answering MAC address.
Every IPv4 conversation on a LAN starts with it; its lack of authentication is what makes ARP spoofing possible.
ARP is how a host with an IP address finds the MAC address to actually send a frame to, and it works by shouting: a broadcast asking who owns this address, answered by whoever does. It predates any notion of a hostile local network, which is the source of everything problematic about it.
There is no authentication anywhere in the protocol. Any host can answer any query, and most implementations accept an unsolicited answer and update their table, which is ARP spoofing: an attacker claims to be the gateway, traffic flows through them, and nothing about the network looks broken. Dynamic ARP inspection on switches is the real defence, because the fix has to live where the frames are switched rather than on the endpoints being lied to.
The everyday value is diagnostic. The ARP table tells you whether a host has resolved its neighbours at all, which separates a layer two problem from a layer three one in seconds. Two entries sharing a MAC address, or a gateway whose MAC changes, is worth investigating immediately. And an incomplete entry means the address was never answered, which usually means the host is not on that segment at all.