Source MAC in the capture is VMWare, Dest MAC is Cisco. Routers first check the TTL before any further process, subtact 1 at R1. Send to R2, subtract and you have ZERO. Discard packet and reply with ICMP Time Exceeded message from that point, don't even bother checking the Route table for futher processing. If Packet was sourced from R1, then R3 would be the last hop and TTL would expire.