I figured out that ARP table for hosts is a little bit different from those for routers.
Routers ARP table only map MAC addresses to IP addresses belonging to the subnets witch router is connected to with its interfaces.
for example if router is connected to 2 subnets: 220.127.116.11 255.255.255.0 and 18.104.22.168 255.255.255.0, you can only find IPs 200.1.1.xxx and 200.1.2.xxx in its ARP table whereas in hosts you can find every possible IP address.
My question is: when a router is forwarding a packet if it needs to find MAC address of next-hop, which IP will fill the destination IP of ARP packet?
next-hop IP or Original packets destination IP?
Routers doesn't do arp for each packet they forward, instead they rely on the routing table (or fib table for cef) in order to find the correct gateway for each destination.
They only do arp for gateway addresses for the very first packet or when entries are removed from arp table due to aging.
ARP packets are not forwarded at Layer 3, they are only useful on the local network since mac-addresses are only significant on the local L2 network. Also ARP packets are an L2 packet they have only L2 destination/source addresses in the frame headers.
For further information about when normal packets (not ARP) are forwarded at Layer 3 (routers, L3 switches, firewalls, etc.): the forwarding decision is based on the destination IP address included in the packet. Only the destination mac-address of the packet is changed as the packet is forwarded to the next router in the path, this ensures the receiving router can correctly direct the packet on its way.
Only if they've been manually added to the table, or a (static) route indicates the target is "local" (i.e. "on the wire".) And that can be done to routers, too.
A router and host use the exact same logic to resolve layer-2 addresses for layer-3 addresses. At layer-2 the src is the device asking, and the dst is the broadcast address (ff:ff:ff:ff:ff:ff). The layer-3 information in the ARP request will be similar -- src ip/mac is the interface address(es) of the device asking, dst ip will be the target desired and mac will be zero because that's what it's looking for.