I figured out that ARP table for hosts is a little bit different from those for routers. Routers ARP table only map MAC addresses to IP addresses belonging to the subnets witch router is connected to with its interfaces. for example if router is connected to 2 subnets: and, you can only find IPs 200.1.1.xxx and 200.1.2.xxx in its ARP table whereas in hosts you can find every possible IP address.

My question is: when a router is forwarding a packet if it needs to find MAC address of next-hop, which IP will fill the destination IP of ARP packet? next-hop IP or Original packets destination IP?

  • If your end host is correctly configured it will not try and arp for off-network addresses...
    – cpt_fink
    May 10, 2015 at 5:56
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 11, 2017 at 16:42

3 Answers 3


Routers doesn't do arp for each packet they forward, instead they rely on the routing table (or fib table for cef) in order to find the correct gateway for each destination. They only do arp for gateway addresses for the very first packet or when entries are removed from arp table due to aging.


ARP packets are not forwarded at Layer 3, they are only useful on the local network since mac-addresses are only significant on the local L2 network. Also ARP packets are an L2 packet they have only L2 destination/source addresses in the frame headers.

For further information about when normal packets (not ARP) are forwarded at Layer 3 (routers, L3 switches, firewalls, etc.): the forwarding decision is based on the destination IP address included in the packet. Only the destination mac-address of the packet is changed as the packet is forwarded to the next router in the path, this ensures the receiving router can correctly direct the packet on its way.


in hosts you can find every possible IP address.

Only if they've been manually added to the table, or a (static) route indicates the target is "local" (i.e. "on the wire".) And that can be done to routers, too.

A router and host use the exact same logic to resolve layer-2 addresses for layer-3 addresses. At layer-2 the src is the device asking, and the dst is the broadcast address (ff:ff:ff:ff:ff:ff). The layer-3 information in the ARP request will be similar -- src ip/mac is the interface address(es) of the device asking, dst ip will be the target desired and mac will be zero because that's what it's looking for.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.