Gyaan

IP Routing & Routers

intermediate routing router ip default-gateway longest-prefix-match

A router is a device that forwards IP packets between networks. Each packet’s destination IP gets looked up in a routing table to decide which interface (and next hop) to send it out of.

In simple language: routers are the postal-sorting offices of the internet. They look at the destination, check their map, and forward toward the next office.

What’s in a Routing Table?

A routing table is a list of rules: “if destination matches this prefix, send the packet to this next hop via this interface.”

# Linux
ip route
# default via 192.168.1.1 dev wlan0
# 169.254.0.0/16 dev wlan0 scope link
# 192.168.1.0/24 dev wlan0 proto kernel scope link src 192.168.1.42

# macOS
netstat -rn -f inet

Each row has at minimum:

  • Destination prefix (e.g. 192.168.1.0/24)
  • Next-hop gateway (or “directly connected”)
  • Interface to send out
  • Optional metric/weight

Default Gateway

When the destination doesn’t match any specific route, the router falls back to 0.0.0.0/0 — the default route. The next hop for that route is the default gateway.

For our home laptop, the default gateway is usually the home router. Anything not in the LAN goes to it, and it figures out the rest.

Longest Prefix Match

When multiple routes match the destination, the router picks the most specific one — the longest prefix.

Routing table:
  10.0.0.0/8     -> next-hop A
  10.1.0.0/16    -> next-hop B
  10.1.2.0/24    -> next-hop C
  0.0.0.0/0      -> next-hop default

Destination: 10.1.2.50
Match candidates: /8, /16, /24, /0
Winner: /24 (longest)  ->  send to next-hop C

This is THE rule of IP routing. Memorize it.

A Hop’s Job

For every packet arriving at a router:

  1. Decapsulate the Ethernet frame (verify CRC, accept if dst MAC = mine).
  2. Decrement the IP TTL. If TTL == 0, drop the packet and send back an ICMP “TTL exceeded.”
  3. Lookup destination IP in the routing table (longest prefix match).
  4. ARP for the next-hop’s MAC (if not already cached).
  5. Re-encapsulate with a new Ethernet header (new dst MAC, our src MAC).
  6. Forward out the chosen interface. Update IP checksum.

The IP source/destination addresses stay the same end-to-end. The MACs change at every hop.

Example: My Laptop to a Server

[laptop 192.168.1.42] -> [home router 192.168.1.1] -> [ISP edge] -> [backbone] -> [server]

At each step, only the next-hop MAC changes. IP src and dst stay constant.

We can visualize hops:

traceroute google.com
# 1  192.168.1.1   (home router)         1.2 ms
# 2  10.0.0.1      (ISP first hop)       8.4 ms
# 3  72.x.x.x      (regional)            12.1 ms
# ...

Static vs Dynamic Routing

  • Static routes — manually configured. Fine for small/stable networks.
  • Dynamic routing — routers exchange routes automatically using protocols (RIP, OSPF, BGP). Self-healing. Required at scale.

We’ll cover algorithms in the next note. For now: static = manual, dynamic = automatic.

Default Gateway From the Host’s Side

A regular host (laptop, server) doesn’t usually run routing protocols. It has just one or two routes:

default via <gateway>     # everything not local goes here
<my subnet> dev <iface>   # local traffic stays on the LAN

That’s why on a misconfigured machine, “I can ping local IPs but not the internet” usually means gateway is wrong.

Forwarding vs Routing

A small distinction:

  • Routing = the process of building the routing table (running protocols, learning paths).
  • Forwarding = the actual per-packet decision based on the table.

Routers do both. The forwarding layer is hot-path and often hardware-accelerated.

Inspecting a Linux Box as a Router

# Enable IP forwarding (turn a Linux box into a router)
sudo sysctl -w net.ipv4.ip_forward=1

# Add a static route
sudo ip route add 10.10.10.0/24 via 192.168.1.50

# Show ARP cache
ip neigh

# See live forwarding decisions
ip route get 8.8.8.8
# 8.8.8.8 via 192.168.1.1 dev wlan0 src 192.168.1.42

Common Gotcha

A common bug: two routes to the same destination with the same prefix length but different metrics. Some OSes load-balance, others pick one based on metric. This is ECMP (Equal-Cost Multi-Path) when load-balanced — useful but can confuse traceroutes.

Interview Tip

The two answers interviewers love: longest prefix match and default gateway. If the question is “how does my packet to Google get there?” walk through: laptop → default gateway → ISP → BGP-routed path → Google’s edge. Shows you understand the layers fit together.

References