Free lesson · Computer Networking

View the routing table

Easy10 min readnetworkingcomputer-networkstcp-ip

The Device That Makes the Internet Possible

Switches move data within a local network. Routers move data between networks. That single distinction - between local delivery and cross-network delivery - is the foundation of the entire internet. Without routers, your laptop could communicate with other devices on your home Wi-Fi but could never reach Google, Netflix, or any server beyond your local network.

A router is a network device that receives packets on one interface, examines their destination IP address, consults a table to determine where to send them next, and forwards them out the appropriate interface toward their destination. Every packet you send to a website crosses multiple routers - typically 10 to 20 - each one making an independent forwarding decision that moves the packet one hop closer to its destination.

The internet is not one network. It is tens of thousands of interconnected networks, each managed by a different organization - ISPs, cloud providers, universities, corporations, governments. Routers are the devices that connect these networks together and make intelligent decisions about how to move traffic between them. Understanding how routers work is essential for any engineer who designs systems that communicate across the internet - which is virtually every modern system.

The Two Functions: Forwarding and Routing

Routers perform two fundamentally different functions, and confusing them is one of the most common misconceptions in networking. These functions operate on entirely different timescales and involve entirely different mechanisms:

Forwarding is the local, per-packet action. When a packet arrives at a router, the router looks at the destination IP address, checks its forwarding table, and sends the packet out the correct interface. Forwarding happens in hardware at line speed - modern routers forward millions of packets per second. It is a data-plane operation: fast, mechanical, and deterministic. Every packet triggers a forwarding lookup.

Routing is the global, background computation. Routing protocols exchange information between routers about which networks exist, which paths are available, and which paths are best. This information is used to build and maintain the forwarding table. Routing happens in software on the router's control processor, runs continuously in the background, and converges over seconds to minutes when the network topology changes. It is a control-plane operation: slow, complex, and algorithm-driven. Routing runs even when no user traffic is flowing.

The analogy is GPS navigation versus driving. Routing is like the GPS calculating the best route from your origin to your destination - it considers the entire road network, traffic conditions, and distance to find the optimal path. Forwarding is like the act of turning the steering wheel at each intersection - following the instructions the GPS computed. The GPS runs in the background and updates the route when conditions change. The steering decisions happen in real time at every turn.

graph TD
    subgraph ControlPlane["Control Plane (Routing)"]
        direction TB
        RP["Routing Protocols<br/>(OSPF, BGP, RIP)"]
        RP --> RT["Routing Table<br/>All known paths<br/>with metrics"]
        RT --> FT["Forwarding Table<br/>(FIB)<br/>Best next-hop<br/>per destination"]
    end

    subgraph DataPlane["Data Plane (Forwarding)"]
        direction TB
        PKT["Incoming Packet"] --> LOOKUP["Lookup destination IP<br/>in Forwarding Table"]
        LOOKUP --> FWD["Forward packet<br/>out correct interface"]
    end

    FT -.->|"Populates"| LOOKUP

    style RP fill:#4f46e5,stroke:#4338ca,color:#fff
    style RT fill:#7c3aed,stroke:#6d28d9,color:#fff
    style FT fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style PKT fill:#a78bfa,stroke:#8b5cf6,color:#fff
    style LOOKUP fill:#c4b5fd,stroke:#a78bfa,color:#000
    style FWD fill:#22c55e,stroke:#16a34a,color:#fff

This diagram shows the separation between the control plane and the data plane in a router. The control plane runs routing protocols like OSPF, BGP, and RIP, which build the routing table containing all known paths with their metrics. The routing table populates the forwarding table, also called the FIB, which contains the best next-hop for each destination. The data plane handles actual packet forwarding: incoming packets have their destination IP looked up in the forwarding table, and are forwarded out the correct interface. The control plane feeds information to the data plane but operates independently.

The Forwarding Table

The forwarding table - also called the FIB (Forwarding Information Base) - is the data structure a router consults for every packet it forwards. It maps destination network prefixes to next-hop addresses and outgoing interfaces.

A simplified forwarding table looks like this:

When a packet arrives with destination IP 172.16.45.10, the router scans the forwarding table for the most specific matching prefix. The entry 172.16.0.0/16 matches (the first 16 bits match), so the router forwards the packet to next-hop 192.168.1.254 via interface eth1.

The entry 0.0.0.0/0 is the default route - it matches every destination. If no more specific entry matches, the router sends the packet to the default route's next hop. The default route is the "if all else fails, send it here" instruction. Every router except the core internet routers (which hold the full global routing table) relies on a default route for destinations it does not know about.

Longest Prefix Match

When multiple entries match a destination IP, the router uses longest prefix match - it selects the entry with the longest (most specific) prefix. If the forwarding table contains both 10.0.0.0/8 and 10.0.1.0/24, a packet destined for 10.0.1.50 matches both, but /24 is more specific (longer prefix), so the router uses the /24 entry.

Longest prefix match is the fundamental algorithm of IP forwarding. It runs for every single packet the router processes, so it must be extremely fast. Modern routers implement it using specialized data structures - typically TCAM (Ternary Content-Addressable Memory) hardware that can perform the lookup in a single clock cycle, or software-based trie data structures for lower-speed routers.

Understanding longest prefix match is important for network design. When you configure routes in a cloud VPC, the most specific route always wins. A route to 10.0.1.0/24 via a NAT Gateway takes precedence over a route to 10.0.0.0/16 via the internet gateway for traffic destined to 10.0.1.x. This is how cloud providers implement the common pattern of routing specific subnets differently from the default route.

The Routing Table

The routing table - also called the RIB (Routing Information Base) - is larger and more complex than the forwarding table. While the forwarding table contains only the best path for each destination (optimized for fast lookup), the routing table may contain multiple paths to the same destination learned from different routing protocols, along with metrics, administrative distances, and path attributes.

The routing table is the input to the route selection process. When multiple paths exist to the same destination, the router selects the best path based on administrative distance (which routing protocol is most trusted), then on the specific metric of that protocol (hop count for RIP, cost for OSPF, path attributes for BGP). The winning path is installed in the forwarding table.

Administrative distance is a simple priority number - lower is more trusted:

If OSPF learns a route to 10.0.5.0/24 and RIP also learns a route to the same network, OSPF wins (110 < 120) and its path is installed in the forwarding table. A static route (distance 1) overrides both. A directly connected network (distance 0) overrides everything. This hierarchy ensures that more reliable information sources take precedence over less reliable ones.

On a Linux machine, you can view the routing table with:

# View the routing table
ip route show

# Example output:
# default via 192.168.1.1 dev eth0
# 10.0.0.0/8 via 10.0.1.1 dev eth1
# 172.16.0.0/16 via 192.168.1.254 dev eth0
# 192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100

Each line shows a destination network, the next hop (via), the outgoing interface (dev), and additional attributes. The proto kernel entry indicates a directly connected network - the router learned about this network from its own interface configuration, not from a routing protocol.

How a Router Processes a Packet

When a packet arrives at a router, the following steps occur in sequence:

Step 1 - Receive. The packet arrives on an ingress interface. The router's network interface card (NIC) receives the Ethernet frame and passes it to the router's processing pipeline.

Step 2 - Strip L2 header. The router removes the Ethernet (Layer 2) header. The source and destination MAC addresses in this header were relevant only for the link between the previous hop and this router - they are no longer needed. This is a critical distinction from switches, which forward based on L2 headers and never examine the IP header.

Step 3 - Check TTL. The router examines the IP header's TTL (Time To Live) field. If TTL is 0 or 1, the router drops the packet and sends an ICMP Time Exceeded message back to the source (this is how traceroute works, as you learned in Module 03). If TTL is greater than 1, the router decrements it by 1. The TTL mechanism prevents routing loops from consuming network resources indefinitely - even if a misconfigured routing table creates a loop, the packet will be dropped after at most 255 hops rather than circulating forever.

Step 4 - Forwarding lookup. The router extracts the destination IP address from the IP header and performs a longest prefix match in the forwarding table. This determines the next hop and outgoing interface. If no matching entry exists and no default route is configured, the router drops the packet and sends an ICMP Destination Unreachable message back to the source.

Step 5 - Build new L2 header. The router creates a new Ethernet header for the next link segment. The source MAC becomes the router's outgoing interface MAC. The destination MAC becomes the next hop's MAC address (obtained via ARP for IPv4 or NDP for IPv6). This is why MAC addresses change at every hop but IP addresses stay the same end-to-end - a fact that is fundamental to understanding how multi-hop internet communication works.

Step 6 - Forward. The router sends the packet with its new Ethernet header out the appropriate interface toward the next hop.

sequenceDiagram
    participant A as Source<br/>10.0.1.10
    participant R1 as Router 1<br/>10.0.1.1 / 10.0.2.1
    participant R2 as Router 2<br/>10.0.2.2 / 172.16.0.1
    participant B as Destination<br/>172.16.0.50

    Note over A,B: MAC addresses change at each hop. IP addresses stay the same.
    A->>R1: Src MAC: AA | Dst MAC: R1<br/>Src IP: 10.0.1.10 | Dst IP: 172.16.0.50
    Note over R1: TTL: 64→63<br/>Lookup 172.16.0.50<br/>→ next hop 10.0.2.2
    R1->>R2: Src MAC: R1 | Dst MAC: R2<br/>Src IP: 10.0.1.10 | Dst IP: 172.16.0.50
    Note over R2: TTL: 63→62<br/>Lookup 172.16.0.50<br/>→ directly connected
    R2->>B: Src MAC: R2 | Dst MAC: BB<br/>Src IP: 10.0.1.10 | Dst IP: 172.16.0.50

This sequence diagram shows a packet traveling from source 10.0.1.10 to destination 172.16.0.50 through two routers. At each hop, the MAC addresses change - the source MAC becomes the sending router's interface MAC and the destination MAC becomes the next hop's MAC. But the IP addresses remain the same throughout: source IP stays 10.0.1.10 and destination IP stays 172.16.0.50. Each router decrements the TTL by 1 and performs a forwarding table lookup to determine the next hop.

Routers in the Cloud

In cloud environments, routing is virtualized but the concepts are identical:

VPC route tables in AWS, GCP, and Azure function exactly like router forwarding tables. Each subnet is associated with a route table that determines where traffic is sent. The most specific matching route wins (longest prefix match), and the default route typically points to an internet gateway or NAT gateway.

Virtual routers handle traffic between subnets within a VPC. When an instance in subnet A sends a packet to an instance in subnet B, a virtual router in the cloud provider's infrastructure performs the forwarding lookup and delivers the packet - just as a physical router would in an on-premises network.

Transit Gateways (AWS) and equivalent services in other clouds act as central routers that connect multiple VPCs and on-premises networks. They maintain route tables, perform forwarding decisions, and enable hub-and-spoke or full-mesh connectivity between isolated network environments.

Understanding routing is the key to understanding VPC networking. When a cloud engineer says "add a route for 10.0.0.0/8 pointing to the transit gateway," they are doing exactly what a network engineer does when configuring a physical router - adding an entry to the forwarding table that says "for this destination prefix, send traffic to this next hop."

Interview: The forwarding-vs-routing distinction appears in System Design interviews when discussing network architecture:

"How does traffic reach your service from the internet?" - The answer traces the routing path: the client's default route reaches their ISP, ISP routers use BGP to find your cloud provider's network, the cloud provider's edge router forwards to the VPC, the VPC route table directs traffic to the load balancer's subnet, and the load balancer forwards to the application server's subnet.

"What happens when you add a new region?" - You need to announce the new region's IP prefixes via BGP so that internet routers learn the path. Within the new VPC, you configure route tables to connect subnets. A transit gateway or peering connection handles inter-region routing.

"Your service has high latency from Europe. Why?" - Traceroute (which exploits the TTL decrement at each router hop) reveals the routing path. If traffic from Europe routes through US-East before reaching US-West, the extra hops add latency. Anycast or regional deployment brings the service closer to users by manipulating routing.

What Comes Next

The next topic examines the two fundamental approaches to building routing tables: static routing (manually configured by an administrator) versus dynamic routing (automatically computed by routing protocols). Static routing is simple but does not scale. Dynamic routing scales but introduces complexity. Understanding when to use each - and why the internet relies entirely on dynamic routing - is essential context for the routing protocol topics that follow.

Exercise: Starter: On your machine, view the routing table. On Mac/Linux: netstat -rn or ip route show. On Windows: route print. Identify the default route (destination 0.0.0.0 or default). What is the next-hop IP? That is your default gateway - the router your machine sends all non-local traffic to.

Intermediate: If you have access to an AWS account, navigate to VPC → Route Tables. Examine the route table associated with a subnet. Identify the local route (traffic within the VPC), the default route (where does internet-bound traffic go?), and any custom routes. How does this map to the forwarding table concept described in this topic? Try adding a custom route and observe how it affects traffic flow.

Advanced: Research the difference between process switching, fast switching, and CEF (Cisco Express Forwarding) in Cisco routers. How does CEF implement longest prefix match in hardware? What is a TCAM and why is it necessary for line-rate forwarding? Modern data center switches from Broadcom (Memory StrataXGS/Memory Memory Memory) and Mellanox use similar hardware forwarding pipelines - research how they implement forwarding at 100 Gbps and beyond.

Back to Computer Networking