Suppose a network stack receives an incoming message:

  • Ethernet sees that EtherType is IPv4 so the payload is forwarded to the IPv4 handler
  • IPv4 sees that the IP protocol number is ICMP so the message is passed to an ICMP handler
  • ICMP type is Echo-Request so an Echo-Reply packet is created and send down to the IP handler
  • IP sends it down to Ethernet
  • However, at this point we need to know the destination MAC address.

How is the destination MAC determined?

  • Is it found by inspecting the ethernet header of the original request?
  • Or is it found using ARP? (Searched in ARP cache and ARP request sent if not in cache.)

I used ICMP request as just one example of an incoming request packet. The same question could be asked for handling i.e. a TCP-SYN packet.

  • ARP stands for Address Resolution Protocol. It resolves layer-3 addresses to layer-2 addresses.
    – Ron Maupin
    Commented Aug 18, 2016 at 14:30

1 Answer 1


Is it found by inspecting the ethernet header of the original request?

No. Routing is not always symmetric, so the request may have come from a different router then the one we need to send the reply to.

Or is it found using ARP? (Searched in ARP cache and potential ARP request required)

Yes. First L3 will look up the destination IP in the routing table to determine the IP address of the next hop, then L2 will look up the next hop in the ARP table (and send out an ARP request if not found in the table).

  • What if the stack implementation is intended to be run on end nodes? (Instead of a routers?) Commented Aug 18, 2016 at 11:53
  • I was thinking of an end node actually. On a router (or firewall) in theory the answer is the same, but it may use some shortcuts to avoid having to do lookups in the routing table and arp table for every packet.
    – hertitu
    Commented Aug 18, 2016 at 12:01
  • 2
    End nodes, routers, firewalls -- all IP devices work the same way.
    – Ron Trunk
    Commented Aug 18, 2016 at 14:22
  • @RonTrunk: I think that's what I said :) But since there are some exceptions though, e.g. NAT can potentially overrule the routing table on a Cisco ASA firewall. PBR on a router does not look at the routing table, etc. That is why I said "in theory".
    – hertitu
    Commented Aug 22, 2016 at 11:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.