That's a great question! It highlights exactly how Layer 2 (Data Link) and Layer 3 (Network) work together.
The reason you don't see google.com in your ARP cache is because ARP (Address Resolution Protocol) only works on your local network segment.
Here is the breakdown of why this happens:
- Local vs. Remote: When you ping
google.com, your computer recognizes that the destination IP address (e.g.,142.250.191.46) is not on your local network (it's not in the172.16.50.0/24range). - The Delivery Man (Default Gateway): Since the destination is remote, your computer doesn't try to find Google's MAC address. Instead, it sends the packet to your Default Gateway (the router, likely
172.16.50.253). - ARP's Job: Your computer only needs to know the MAC address of the gateway to get the packet out of your local network. You can see the gateway's MAC address in your
arp -aoutput:_gateway (172.16.50.253) at ee:ff:ff:ff:ff:ff [ether] on eth0 - Hops: The router then receives the packet, looks at the destination IP, and passes it to the next router. This continues until it reaches Google's servers.
Summary: Your computer only uses ARP to talk to its immediate neighbors. To talk to the rest of the world, it just needs to know how to reach the "exit door" (the gateway)!
Does that clarify the difference between how local and remote traffic is handled?