For a outgoing packet, by
route I can know which interface is using, but for a incoming packet, how to find out which interface is using?
In general, Linux expects a packet to enter through the same interface as it would exit.
When that is not the case, the kernel reports a packet as a martian, and if you have the following sysctl value set, packets will be dropped if they are seen from an interface which cannot route back to the (the
rp_filter standard for Reverse Path).
net.ipv4.conf.all.rp_filter = 1
So normally, unless you have a particularly complicated routing table or setup, you can check the output of
ip r and make an educated guess.
Most likely, you will want to check what your default route is, and there will be a strong chance that the answer to your question will be "whatever interface your default route is pointing to".
All of the above can be changed by the admins if necessary, but in general, AFAIK this is how most systems work.
the packet will come from its ip address interface ( destination address) otherwise it will not reach the interface and the packet is ignored ( like in a hub) if the packet is a broadcast then it will come from all the interfaces connected to that broadcast domain ( one of the reason why only one ip should be in the same ip subnet)
same goes at MAC level