Routing Across Networks

How Packets Move Between Networks

Routing connects separate IP networks into an interconnected network of networks. A router receives a packet, examines its destination IP address, and chooses a next hop rather than needing complete knowledge of the packet's entire physical journey.

Two related activities make this possible:

• Routing learns or calculates which paths are available.

• Forwarding applies a selected path to an individual packet.

A typical packet-handling sequence is:

1. Receive an IP packet inside a link-layer frame.

2. Validate the packet and read its destination IP address.

3. Find the best matching destination prefix.

4. Select the associated next hop and outgoing interface.

5. Decrease the packet's TTL so that looping packets do not live indefinitely.

6. Resolve the next-hop link-layer address when necessary.

7. Encapsulate the packet in a new link-layer frame and transmit it.

The link-layer frame normally changes at every hop, while the IP destination generally remains the same from source to destination. If no usable route exists, the router normally discards the packet and may generate an ICMP error.

Takeaway: Routing chooses a path; forwarding uses that choice to move each packet one hop at a time.

Choosing the Best Matching Route

Routing tables store destination prefixes, not necessarily a separate entry for every host. When several entries match a destination, the router applies Longest-prefix matching and selects the most specific prefix.

For example, consider these entries:

• Destination prefix 192.0.2.0/24 — next hop Router A

• Destination prefix 192.0.2.128/25 — next hop Router B

• Destination prefix 0.0.0.0/0 — next hop Router C

A packet sent to 192.0.2.150 matches all three entries, but 192.0.2.128/25 is the most specific match, so the packet goes to Router B. A packet sent to 192.0.2.60 uses the /24 route. An unrelated destination uses the default route, 0.0.0.0/0.

This mechanism allows an organization to advertise a broad route while creating more-specific exceptions. It also explains why an unexpected more-specific entry can override the path an administrator expected.

Takeaway: When troubleshooting a route, do not stop at finding a matching prefix; determine which matching prefix is most specific.

From Routing Knowledge to Forwarding Decisions

A router commonly separates the information used to understand routing from the data used for rapid packet handling.

• The routing information base (RIB) contains routes from directly connected networks, static configuration, and routing protocols. It may hold multiple candidates for one destination.

• The forwarding information base (FIB) contains optimized entries selected from the preferred routes in the RIB. The router consults it for each arriving packet.

• Neighbor or link-layer caches map next-hop IP addresses to link-layer addresses when the local network technology requires that mapping.

The router applies route-selection rules, installs the preferred result in the FIB, and then uses the FIB during forwarding. Routing protocols calculate reachability; they do not normally carry application data.

Takeaway: The RIB represents available routing knowledge, while the FIB is the optimized structure used for fast forwarding.

Static and Dynamic Routing

A static route is manually configured with a destination prefix and either a next-hop address or an outgoing interface. For example, a route might specify Destination: 10.20.0.0/16 and Next hop: 203.0.113.2.

Static routes are useful when a network has one exit path, a small branch needs a simple default route, an administrator wants a predictable backup, or a special policy boundary requires deliberate configuration. Their central weakness is that they do not automatically adapt when a link or router fails. A route can remain installed even after its next hop becomes unreachable unless tracking or failover is available.

Dynamic routing protocols allow routers to exchange reachability information and adapt to topology changes. They commonly:

1. Discover neighboring routers.

2. Advertise reachable networks or topology information.

3. Calculate or select paths.

4. Remove, replace, or adjust routes when information changes.

Dynamic routing improves resilience by allowing an alternate path to be learned after a failure. The trade-off includes additional control-plane traffic, processing complexity, configuration requirements, and the risk that incorrect routing information will spread.

Takeaway: Static routing favors manual predictability; dynamic routing favors adaptation and resilience.

Routing Protocols and Path Selection

Dynamic protocols use different ways to describe and compare paths.

Distance-vector routing

A distance-vector protocol tells neighbors which destinations it can reach and the distance or cost associated with each destination. Each router uses neighbor information to calculate its own routes. RIP is a classic example, using hop count as its general metric. A path through three routers has a greater hop-count metric than a path through two routers, but hop count is only a limited measure of path quality.

Distance-vector protocols must address routing loops, slow convergence, and misleading information caused by neighbors learning routes from one another. Split horizon, route poisoning, and hold-down timers can reduce these problems.

Link-state routing

A link-state protocol distributes information about network links and their states. Each router builds a link-state database that represents the topology and independently calculates a shortest-path tree. OSPF is a link-state IGP. It supports topology databases, shortest-path calculation, areas, and equal-cost multipath when multiple paths have the same metric.

Because participating routers calculate from a shared view of topology, link-state protocols can converge quickly and make detailed path decisions. They generally require more memory and processing than very simple distance-vector protocols.

Comparing paths

A routing metric may represent hop count, configured link cost, bandwidth, delay, reliability, administrative preference, policy attributes, autonomous-system path length, or measured performance. Its meaning depends on the protocol and local configuration. A router may also apply a local preference among routes learned from different sources before comparing metrics within one protocol.

If multiple paths have the same preferred metric, equal-cost multipath (ECMP) may allow the router to install more than one next hop. Traffic can then be distributed across the available paths, often using a flow-based hash so that one transport connection usually follows the same path.

Takeaway: Protocol type determines how routing information is gathered, while metrics and local preference determine which available paths are preferred.

Autonomous Systems and BGP

An autonomous system (AS) is a group of networks and routers operated under common administration and policy. Within an AS, administrators generally focus on internal reachability, efficiency, and convergence. Between ASes, route selection also reflects business relationships, traffic engineering, security, and policy.

An AS is identified in routing protocols by an autonomous system number. A destination prefix can be reachable through several AS-level paths, but the selected path is not necessarily the one with the shortest physical distance.

The Border Gateway Protocol (BGP) exchanges reachability information between autonomous systems. Its advertisements include a destination prefix and path attributes, including:

• AS_PATH, which records the sequence of autonomous systems through which the route has passed, helps prevent loops, and can influence selection.

• NEXT_HOP, which identifies the IP address of the router to use as the next hop.

• LOCAL_PREF, which expresses a preference for an external route within an AS.

• MED, which can help distinguish among multiple entry points into a neighboring AS.

• ORIGIN, which describes how the route was introduced into BGP.

BGP is policy-based rather than a simple choice of the path with the fewest links or lowest delay. An administrator might prefer one provider for cost, another for performance, or a particular exit point for traffic engineering.

• External BGP (eBGP) exchanges routes between different autonomous systems.

• Internal BGP (iBGP) distributes BGP-learned routes within one autonomous system.

BGP commonly works with an IGP: the IGP provides internal reachability to BGP next hops, while BGP selects and advertises external prefixes. BGP can also aggregate several more-specific routes into a shorter prefix. Aggregation reduces table size and update traffic, but an overly broad summary can hide failures or direct traffic toward an AS without a working path to every address in the summary.

Takeaway: Interdomain routing is governed by policy and path attributes, not just by physical distance or hop count.

Convergence, Faults, and Resilience

Convergence begins when routers detect a topology change and ends when their forwarding state has settled on the new preferred paths. A typical failure sequence is:

1. A link fails or a neighbor becomes unreachable.

2. The connected router detects the failure through the link layer, protocol timers, or a keepalive mechanism.

3. Affected routes are withdrawn or invalidated.

4. Neighboring routers propagate the change.

5. Routers recalculate their preferred paths.

6. Forwarding tables are updated, allowing traffic to use an alternate path if one exists.

During this process, packets can be delayed, dropped, or temporarily sent along inconsistent paths. Redundant links, multiple routers, ECMP, fast failure detection, and carefully designed routing domains reduce the impact. More connectivity improves resilience but also increases route-calculation and policy-management complexity.

Common failure categories include:

• Physical and link failures: damaged fiber, copper, radio, power, transceivers, ports, line cards, or optical components.

• Configuration errors: incorrect subnet masks or prefix lengths, wrong next hops, missing static routes, accidental default routes, or incorrect redistribution.

• Protocol failures: authentication mismatches, incompatible timers, failed OSPF or BGP adjacencies, expired hold timers, incorrect areas or ASNs, and filtering errors.

• Loops and black holes: a routing loop repeatedly forwards packets among routers, while a black hole sends traffic toward a path where it is discarded or cannot progress.

• Policy and security problems: rejected advertisements, unexpected provider preferences, accidental prefix leaks, false route advertisements, or validation and filtering that blocks a legitimate route.

A physically functioning link is not sufficient for reachability. Protocol state, policy, route installation, and forwarding behavior must also be correct.

Takeaway: Fault tolerance depends on both alternate physical paths and correct control-plane and forwarding-plane behavior.

Diagnosing Routing Problems

A systematic investigation should move from the local device outward:

1. Check the interface. Confirm that it is administratively enabled, has carrier and an address, and shows acceptable error rates.

2. Check the local routing table. Determine whether a route matches the destination.

3. Check longest-prefix selection. Look for a more-specific route overriding the expected path.

4. Check the next hop. Verify that it is reachable through the selected interface.

5. Check the routing protocol. Confirm that the neighbor relationship is established and that routes are being received and advertised.

6. Trace the path. Use tools such as traceroute or tracert, while remembering that filtering, load balancing, and ICMP behavior can make results incomplete.

7. Check return routing. The forward path may work while the reverse path fails because Internet routing is often asymmetric.

8. Check policy and filtering. Firewalls, prefix lists, route maps, and security controls may block either route advertisements or data packets.

This sequence connects symptoms to likely causes. A missing route points toward table or protocol investigation; an unexpected path points toward prefix specificity or policy; failure after a particular hop points toward the next hop, a downstream route, or return routing; and intermittent paths may require checking ECMP, convergence, or changing protocol state.

Takeaway: Verify interface health, route selection, next-hop reachability, protocol state, path behavior, return routing, and policy in that order.