Arping for local broadcast address

(BOOTP exists within DHCP these days)

The process starts with the client sending a broadcast request as it generally will not know any server address(es) -- src ip will be zero, since it doesn't have an address yet. The server will look up the MAC within the request to form an answer. How that answer gets back requires a bit more thought. If the server sends a simple unicast reply, it will need an arp cache entry to know where to send it. The normal ARP discovery mechanism won't work because the client doesn't have its address yet. So, the server must either update it's ARP cache prior to sending the answer, or send the answer as a broadcast message. (or bypass the host layer-3/4 processing by forming it's own layer-2 packet and sending it directly)

Furthermore, the server cannot assume the client is on the same wire. So, the answer must be sent to where ever the request came from -- i.e. any possible relay agent, not the hardware address within the request.

Answer to first question:

In a LAN if the source and destination are part of the same subnet or broadcast domain then they do not need to pass through gateway. They can reach each other directly (typically in a bus topology). If any network device comes in between its a switch. A gateway comes into picture when you need to reach a host machine that is part of different LAN segment or both having different broadcast domain.

To determine whether two hosts are part of same network, two IP addresses are AND'd with a subnet mask if the result is the same then they are on the same network.

Answer to your second question:

The target mac address in the arp packet is by default set to zero and is ignored according to RFC 5227. The destination mac address in L2 header is correctly set to ff:ff:ff:ff:ff:ff for broadcast arp request.