How Does Linux Find a MAC Address? | ARP & Neighbor Resolution From First Principles

Linux has selected a route. It knows the output interface and, when needed, the next-hop IP. But is that enough to actually transmit an IPv4 packet over Ethernet? In this episode of Linux Networking From First Principles, we continue following the packet and investigate the missing piece: the link-layer destination. We use Linux routing, the neighbour table, ARP, arping, ping, and tcpdump to prove what happens. You will see: • Why selecting eth0 is not enough to transmit an Ethernet frame • The difference between an IP destination and an Ethernet destination • How Linux maps a directly reachable IPv4 neighbour to a MAC address • What an ARP request and reply look like on the wire • Why a packet destined for 1.1.1.1 can have the gateway's MAC address as its Ethernet destination • What happens when Linux has a valid route but cannot resolve the neighbour • Why a route tells Linux where to try — not whether the destination actually exists or is reachable The central mental model: Destination IP → route lookup → output interface + next-hop IP → neighbour information / resolution → link-layer destination → Ethernet frame How can we prove it? We use packet capture at the Ethernet interface and deliberately break neighbour resolution to observe the failure. TECHNICAL CLARIFICATION At one point I say that the “next-hop IP keeps changing” as a packet travels toward its destination. More precisely: the packet's destination IP does not become the next-hop IP. Each router along the path independently performs a route lookup for the destination and may select a different next hop. When Ethernet is used on a particular link, the Layer-2 addressing is for that link. This explanation assumes no address translation such as NAT. PREVIOUS EPISODES Episode 1 — What Is Linux Loopback?    • What Is Linux Loopback? Understanding 127....   Episode 2 — How Does Linux Decide Where a Packet Goes?    • How Does Linux Decide Where a Packet Goes?...   Series: Linux Networking From First Principles Learn to predict where the packet goes. CHAPTERS 00:00 Continuing the Packet Journey 01:12 Why Ethernet Needs a Destination MAC 03:20 Route, Next Hop, and the Neighbour Table 05:41 How Does Linux Learn the MAC Address? 06:20 Proving ARP with tcpdump and arping 09:22 Remote Destination: 1.1.1.1 11:29 Final IP Destination vs Link-Layer Destination 12:20 A Route Exists — But Does the Neighbour? 14:27 Deliberately Breaking Neighbour Resolution 16:11 Proving the Failure with Packet Capture