Routing Basics

Network learning path · Step 6Available

Read routing tables, apply longest prefix match and trace both forward and return paths through a routed network.

Difficulty: Intermediate
Time: 70 min
Practice: Two-router path
Assessment: Knowledge check

Before you start

Who is this for?

For learners who want to trace the path of a packet between multiple IP networks.

Prerequisites

IPv4, prefix and default gateway
Subnetting basics

What you'll be able to do

Read routing tables using longest prefix match
distinguish static, direct, and dynamic routes
deliberately test both forward and return paths

Practical outcome

You can plan a small two-router lab and systematically identify missing routes.

Routing determines which next hop an IP packet uses to reach its destination network. Hosts already make a first routing decision: if the destination is local, they send directly; otherwise they use a gateway. Routers repeat this decision at every hop along the path.

1. Local or remote destination

A host compares its own IP with the destination IP using the prefix. For 192.168.10.25/24, 192.168.10.80 is local, while 192.168.20.80 is remote.

For a local IPv4 destination, the host determines its MAC address via ARP. For a remote destination, it determines the MAC address of its default gateway. The Ethernet frame only travels to the next hop; the IP destination address still refers to the actual destination.

2. Entries in a routing table

A routing entry typically contains:

Destination prefix, for example 10.20.0.0/16;
Next hop, for example 192.168.1.1, or an outgoing interface;
Source, such as directly connected, static, or dynamically learned;
Metric or cost;
depending on the platform, administrative distance or preference.

Example:

10.20.0.0/16 via 192.168.1.2
10.20.30.0/24 via 192.168.1.3
0.0.0.0/0 via 192.168.1.1

For a packet to 10.20.30.50, all three entries match. The route 10.20.30.0/24 is chosen because it has the longest, and therefore most specific, prefix. This principle is called Longest Prefix Match.

3. Default route

The IPv4 default route 0.0.0.0/0 and its IPv6 equivalent ::/0 match every destination. They are used only when no more specific entry exists. A client often has a default route to its local router; a small branch router has a default route to the provider.

If no matching route exists, the packet is dropped. Depending on the situation, the sender may receive an ICMP unreachable message. A valid forward route does not guarantee success: the return path must also work.

4. Static and dynamic routes

Directly connected routes are created when an active router interface is configured with a prefix. Static routes are entered manually. They are predictable and suitable for small, stable networks, but they do not automatically react to topology changes.

Dynamic routing protocols exchange reachability information:

OSPF and IS-IS are often used within larger organizations;
BGP connects autonomous systems and carries policies on the Internet or in large environments;
RIP is simple, scales only to a limited degree, and is now often used for training or legacy environments.

Dynamic does not automatically mean better: design, hardening, summarization, and monitoring remain necessary.

5. What a router does with a packet

The router receives a Layer 2 frame and validates it.
It removes the local frame header and examines the destination IP.
It decrements the TTL for IPv4, or the hop limit for IPv6.
It selects the best route using longest prefix match.
It determines the next Layer 2 receiver on the outgoing network.
It encapsulates the IP packet in a new frame and forwards it.

When TTL or hop limit reaches zero, the router drops the packet. traceroute and tracert use exactly this behavior to make hops visible.

6. Metric, preference, and equal-cost paths

If multiple routes exist for the same destination prefix, the system first compares the trustworthiness of their sources, then the protocol-specific metric. Names and default values differ between vendors and operating systems.

Several equal-cost paths can be used for Equal-Cost Multi-Path (ECMP). This usually means distribution by flows, not that each individual packet alternately takes a different path.

Routing and NAT are separate functions: routing selects the path; NAT changes address or port information. Likewise, a firewall decides whether traffic is allowed. A home router often performs all three functions at once.

7. Troubleshooting

# Windows
Get-NetRoute
tracert -d 203.0.113.10
Test-NetConnection 203.0.113.10 -TraceRoute

# Linux
ip route
ip route get 203.0.113.10
traceroute -n 203.0.113.10

Check systematically:

Do the sender IP and prefix match?
Is the local gateway reachable?
Which route is selected for the specific destination IP?
Is the next hop in a directly reachable network?
Are interfaces and VLANs active?
Does a route exist back to the source network?
Does an ACL or firewall drop the traffic?
Is NAT changing the connection as expected?

A missing traceroute hop by itself does not prove a failure; devices can filter diagnostic replies while continuing to forward user traffic.

Practical lab

Create three networks: 192.168.10.0/24, a transit network 10.0.0.0/30, and 192.168.20.0/24. Connect the two LANs through two routers.

Configure addresses and gateways on both sides.
First check only directly connected networks.
Add a static route to the remote LAN on each router.
Compare the routing table and the actual path.
Test by removing a return route and explain why the ping fails.
Then add default routes only where they are technically appropriate.

Document the next hop, source IP, and destination IP for every packet. Also add the local source and destination MAC addresses for each Ethernet segment.

Common mistakes

Testing only the forward path and missing a missing or filtered return route.
Comparing metrics before longest prefix match has selected the most specific prefix.
Configuring a next hop outside a directly reachable network without understanding recursive resolution.
Treating routing, NAT, and firewall as the same decision.
Interpreting a single missing traceroute hop as proof of user traffic loss.

Knowledge check

What you should now be able to do

read a routing table with longest prefix match;
distinguish direct, static, and dynamically learned routes;
deliberately test the forward path, return path, and filtering rules;