Routing Basics

What routing is and why it is needed

A switch connects devices inside one network. As soon as a packet has to leave its own network — from an office local area network (LAN) to a data center, or from your laptop to a website — something must decide which way it goes. Routing is that process: choosing a path for a packet from one network to another, based on its destination IP address, and forwarding it one step along that path.

A router is the device that does this. It has an interface in each network it connects, and it works at layer 3 of the Open Systems Interconnection (OSI) model (the network layer). A host decides only one thing: is the destination in my own subnet? If yes, it delivers the packet directly; if not, it hands the packet to its default gateway, which is a router. From there, every router along the way makes its own, independent decision about the next step. No single device knows or plans the whole path.

Why not one big network? Because broadcasts, addressing and failures would all spread everywhere. Routers are the boundaries: they stop broadcasts, let each network have its own address range (see Subnetting), and give you a place to apply policy such as access control lists.

The example network used on this page:

The routing table

The routing table is the list of networks a router knows how to reach, and for each one where to send the packet next. Every router has one, and so does every host (on a PC it usually holds little more than the local subnet and a default route). On a Cisco router you view it with show ip route, the command you will type most often when troubleshooting reachability:

R1# show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       … (remaining code lines trimmed)

Gateway of last resort is 203.0.113.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 203.0.113.1
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.0.12.0/30 is directly connected, GigabitEthernet0/1
L        10.0.12.1/32 is directly connected, GigabitEthernet0/1
      172.16.0.0/24 is subnetted, 1 subnets
O        172.16.30.0 [110/2] via 10.0.12.2, 00:14:07, GigabitEthernet0/1
      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/24 is directly connected, GigabitEthernet0/0
L        192.168.1.1/32 is directly connected, GigabitEthernet0/0
S     192.168.2.0/24 [1/0] via 10.0.12.2
      203.0.113.0/24 is variably subnetted, 2 subnets, 2 masks
C        203.0.113.0/30 is directly connected, GigabitEthernet0/2
L        203.0.113.2/32 is directly connected, GigabitEthernet0/2

The letter at the start of each line is the route code: how the router learned that route. The indented lines without a code are only headings that group subnets of the same classful network.

Reading one learned route from left to right:

• O — learned through OSPF.
• 172.16.30.0 — the destination network; its mask (/24) is in the heading line above it.
• [110/2] — administrative distance 110 (how much the router trusts the source) and metric 2 (the cost of this path).
• via 10.0.12.2 — the next hop.
• 00:14:07 — how long ago the route was learned.
• GigabitEthernet0/1 — the exit interface.

Next hop and exit interface

A route does not describe the whole path; it describes only the next step. The next hop is the IP address of the neighboring router that should receive the packet next, and it must be reachable in a directly connected network. The exit interface (outgoing interface) is the router's own interface that leads there. For 192.168.2.0/24, R1's next hop is 10.0.12.2 (R2) and its exit interface is GigabitEthernet0/1.

When a route lists only a next hop, the router does a recursive lookup: it looks up the next-hop address in its own table to find which connected network, and so which interface, leads to it. Here 10.0.12.2 falls in the connected route 10.0.12.0/30 on GigabitEthernet0/1.

The forwarding decision

For every packet that arrives, a router goes through the same steps. Seeing them in order explains most routing problems you will meet in tickets:

1. Receive the frame, check that it is addressed to this router's MAC address and that the frame check sequence is correct, then remove the layer 2 header and trailer.
2. Read the destination IP address and look it up in the routing table. The most specific matching route wins (next section).
3. No match and no default route? Drop the packet and send an Internet Control Message Protocol (ICMP) "destination unreachable" message back to the sender.
4. Lower the time to live (TTL) by one. If it reaches zero, drop the packet and send ICMP "time exceeded" back. This stops packets from circling forever in a routing loop.
5. Find the layer 2 address of the next hop (or of the destination itself, if it is in a connected network), using an Address Resolution Protocol (ARP) request or the ARP cache.
6. Build a new frame for the exit interface and send it.

See ARP and ICMP for steps 3 to 5 in detail.

Longest prefix match

A destination address often matches several routes at once: a default route matches everything, a /8 matches a large block, a /24 a small part of it. The rule that decides is longest prefix match: the router uses the matching route with the longest prefix length, because that route describes the destination most precisely.

A worked example

A router has these four routes:

A packet for 10.20.30.40 matches all four: its first 8 bits are 10, its first 16 bits are 10.20, its first 24 bits are 10.20.30, and every address matches /0. The /24 is the longest, so the packet goes to 10.0.14.4. A packet for 10.20.99.1 does not match the /24 (its third octet is 99, not 30), so the /16 wins. The same logic in Python, with the standard ipaddress module:

import ipaddress

routing_table = [
    ("0.0.0.0/0", "203.0.113.1"),
    ("10.0.0.0/8", "10.0.12.2"),
    ("10.20.0.0/16", "10.0.13.3"),
    ("10.20.30.0/24", "10.0.14.4"),
]
routes = [(ipaddress.ip_network(prefix), hop) for prefix, hop in routing_table]


def best_route(destination):
    address = ipaddress.ip_address(destination)
    matches = [(net, hop) for net, hop in routes if address in net]
    best = max(matches, key=lambda route: route[0].prefixlen)
    return best, len(matches)


for destination in ["10.20.30.40", "10.20.99.1", "10.99.0.1", "198.51.100.7"]:
    (network, hop), count = best_route(destination)
    print(f"{destination:<13} matches: {count}  best: {str(network):<14} via {hop}")

10.20.30.40   matches: 4  best: 10.20.30.0/24  via 10.0.14.4
10.20.99.1    matches: 3  best: 10.20.0.0/16   via 10.0.13.3
10.99.0.1     matches: 2  best: 10.0.0.0/8     via 10.0.12.2
198.51.100.7  matches: 1  best: 0.0.0.0/0      via 203.0.113.1

address in net is exactly the router's test: do the first prefix length bits of the address equal those of the network? Real routers do not scan a list; they store routes in specialized tree structures or hardware so a lookup takes the same short time with a million routes, but the result is the same.

Static routes

A static route is a route an administrator configures by hand. It never changes by itself: if the path breaks, the route stays (as long as its exit interface is up) and traffic is lost until someone changes it. Static routes are simple, predictable and use no bandwidth or central processing unit (CPU) time, which makes them a good fit for small networks, stub networks with only one way out, and default routes toward an Internet provider.

On R1, three ways to reach 192.168.2.0/24 behind R2:

R1(config)# ip route 192.168.2.0 255.255.255.0 10.0.12.2
R1(config)# ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/1
R1(config)# ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/1 10.0.12.2

• Next-hop route (line 1): the syntax is ip route network mask next-hop. The mask is written in dotted decimal, not as /24. The router finds the exit interface with a recursive lookup. This is the most common form.
• Directly attached route (line 2): only an exit interface. It appears as "directly connected" in the table. Fine on a point-to-point serial link, but on Ethernet the router must ARP for every destination address and depends on the neighbor answering with proxy ARP, so avoid it there.
• Fully specified route (line 3): both exit interface and next hop. No recursive lookup, and no proxy ARP needed.

In practice you configure one of these, not all three. Remember that routing works in both directions: R2 also needs a route back to 192.168.1.0/24, or the replies never arrive. A one-way route is one of the most common causes of "ping fails but the route is there".

The default route

A default route is the route with prefix 0.0.0.0/0. A prefix length of zero means no bits need to match, so it matches every address — and because it is the shortest possible prefix, it is used only when nothing more specific matches. It is how an office router sends everything that is not internal to its Internet provider, and it is the same idea as the default gateway on a PC.

R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1
R1(config)# end
R1# show ip route static
…
Gateway of last resort is 203.0.113.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 203.0.113.1
S     192.168.2.0/24 [1/0] via 10.0.12.2

Both the network and the mask are 0.0.0.0. Cisco calls the chosen default the gateway of last resort; the asterisk in S* marks the candidate default. When the table shows "Gateway of last resort is not set", packets for unknown networks are dropped.

Floating static routes

You can give a static route a higher administrative distance by adding a number at the end. It then loses from any route with a lower distance for the same prefix, and stays out of the routing table — "floating" above it — until the preferred route disappears. That makes it a simple backup path. Suppose R1 learns 172.16.30.0/24 from OSPF (distance 110) over the main link, and has a second link to R2 on 10.0.99.0/30:

R1(config)# ip route 172.16.30.0 255.255.255.0 10.0.99.2 130

With distance 130, the static route is ignored while OSPF offers the route with 110. If the main link fails and OSPF withdraws its route, the static route enters the table and traffic takes the backup link. Administrative distance itself is explained on Dynamic Routing and OSPF.

What happens hop by hop

Follow one packet from PC1 to PC2 in the diagram. PC1 sees that 192.168.2.20 is not in its own subnet, so it sends the packet to its default gateway, R1. R1 forwards it to R2, and R2, which is directly connected to 192.168.2.0/24, delivers it to PC2. On each link the packet travels inside a new Ethernet frame:

# One packet from PC1 (192.168.1.10) to PC2 (192.168.2.20)
links = [
    ("PC1 -> R1", "00-00-5E-00-53-10", "00-00-5E-00-53-01"),
    ("R1 -> R2", "00-00-5E-00-53-11", "00-00-5E-00-53-21"),
    ("R2 -> PC2", "00-00-5E-00-53-20", "00-00-5E-00-53-22"),
]
ttl = 64
print("IP header on every link: 192.168.1.10 > 192.168.2.20")
for link, src_mac, dst_mac in links:
    print(f"{link:<10} frame {src_mac} > {dst_mac}  TTL {ttl}")
    ttl -= 1  # the next router lowers the TTL by one before forwarding

IP header on every link: 192.168.1.10 > 192.168.2.20
PC1 -> R1  frame 00-00-5E-00-53-10 > 00-00-5E-00-53-01  TTL 64
R1 -> R2   frame 00-00-5E-00-53-11 > 00-00-5E-00-53-21  TTL 63
R2 -> PC2  frame 00-00-5E-00-53-20 > 00-00-5E-00-53-22  TTL 62

The pattern to remember: MAC addresses change on every hop, IP addresses stay the same end to end. A MAC address only means something inside one layer 2 network, so each router removes the old frame and builds a new one with its own exit interface as source and the next device as destination. The IP header is carried unchanged, except that the TTL drops by one per router (which also means its header checksum is recalculated). The exception is network address translation: a router doing NAT deliberately rewrites IP addresses, and often ports (see NAT and PAT).

IPv6 static routes

IPv6 routing works the same way, with its own table (show ipv6 route) and its own commands. A Cisco router forwards IPv6 only after ipv6 unicast-routing is enabled. Prefixes are written with their length, not with a mask:

R1(config)# ipv6 unicast-routing
R1(config)# ipv6 route 2001:db8:2::/64 2001:db8:12::2
R1(config)# ipv6 route 2001:db8:2::/64 GigabitEthernet0/1 fe80::2
R1(config)# ipv6 route ::/0 2001:db8:ff::1

• Line 1 turns on IPv6 routing (off by default).
• Line 2 is a next-hop route using R2's global address.
• Line 3 uses R2's link-local address as next hop. Link-local addresses exist on every link, so the exit interface is required to say which link is meant.
• Line 4 is the IPv6 default route; ::/0 matches every IPv6 address. See IPv6 Basics for the address types.