there are strange things:

on my virtualbox:


lo:0 (ip alias)


default via dev lo dev enp0s3

enp0s3 is plugged in

I have enabled the ip_forward (net.ipv4.ip_forward = 1)

My Question:

ping works,but why?

tcpdump can't get packets on enp0s3,but does get packets on lo.

The default route is lo; why does ping work? Why can't I get packets on enp0s3?


The loopback interface is a virtual interface. The only purpose of the loopback interface is to return the packets sent to it, i.e. whatever you send to it is received on the interface. It makes little sense to put a default route on the loopback interface, because the only place it can send packets to is the imaginary piece of wire that is looped from the output of the interface to the input. There is nothing that can change this behaviour of the loopback interface, that's what it is coded to do.

When you ping, the reply does not come from some external device, but from the loopback interface itself. When you add an address on the loopback interface with e.g.

sudo ip addr add dev lo

a route to is added. You can see this with

ip route show table local

Something like

local dev lo proto kernel scope host src

should show up. This routing table entry tells that a packet sent to any address between and is sent via the lo interface, from which it is immediately returned.

EDIT: clarification as a response to the comment below.

Here is what happens when you ping the kernel gets an IP packet for delivery with a destination address Just like with any packet to be delivered, the kernel consults the routing table. In this case the matching entry is this: local dev lo proto kernel scope host src, which says the packet should be delivered via the lo interface with the source address

Now, because the packet was given to the lo interface, the loopback interface does what it normally does: it takes the packet off the send queue and puts it on the receive queue. From the kernel's point of view, we have now received an incoming packet ready for consumption by a server process listening on a socket. (In the case of ping, the kernel processes it internally.) We have now received a "remote" ICMP packet with a destination address of, which is arguably not one of our local addresses, but it was delivered to the loopback interface nonetheless.

Next, the kernel sends a response to the ping: an ICMP response packet with the addresses reversed: as source address and as destination. This is delivered via the loopback interface back to the ping program, which shows that we got a reply from

  • Thank you for answering. But I still don't know why can I recieve the icmp response from Is the icmp response from my centos7?This IP is not mine.
    – godcrying
    May 10 '17 at 7:50

Answering your other question, "Why can't I get packets on enp0s3?"

It's pointed to the LAN at

Therefore, unless you have a server on the LAN that responds to package delivery requests, you get nada via that route.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.