Module 6: Routing

Modules 4 and 5 explained how addressing and subnet boundaries determine whether a destination is local. Routing begins when the destination is not.

Every host and router has a routing table. It is a list of instructions that answers one question: where should this packet go next?

In This Module

• How a routing table describes connected and next-hop paths
• Longest prefix match
• The default route
• Following a path with traceroute

The Routing Table

A route normally contains four useful pieces of information.

Field	Meaning
Destination	The network or host the route matches
Next hop	The router that should receive the packet next
Interface	The local network interface used to send it
Metric	A value used to choose between equally specific routes

Consider this simplified table:

Destination	Next hop	Interface	Metric
192.168.10.0/24	On-link	Ethernet	25
10.20.5.0/24	192.168.10.2	Ethernet	50
10.20.0.0/16	192.168.10.1	Ethernet	10
0.0.0.0/0	192.168.10.1	Ethernet	25

On-link means the destination is directly reachable on the local network. The host uses the Address Resolution Protocol (ARP) to find the destination’s media access control (MAC) address and sends the frame directly.

When a next hop is listed, the host keeps the packet’s final destination Internet Protocol (IP) address but sends the local frame to that router’s MAC address.

Longest Prefix Match

More than one route can match the same destination. The route with the longest prefix wins because it describes the smallest, most specific range.

Using the table above, consider 10.20.5.25.

It matches:

• 10.20.5.0/24
• 10.20.0.0/16
• 0.0.0.0/0

The /24 route wins. It sends the packet to 192.168.10.2, even though that route has a higher metric than the /16.

Choose the longest matching prefix first.
Use the metric only to choose between equally specific routes.

This is the same idea as choosing a street address over a city name. Both describe the destination, but one is more precise.

The Default Route

The route 0.0.0.0/0 is the default route.

A /0 fixes none of the address bits, so it matches every Internet Protocol version 4 (IPv4) destination. Because every more specific route has a longer prefix, the default is used only when nothing better matches.

On a workstation, the default route normally points to the default gateway learned from the Dynamic Host Configuration Protocol (DHCP) or configured manually.

0.0.0.0/0 -> default gateway

Without a matching route or a default route, the host does not know where to send the packet.

View Your Routes

On Windows:

route print -4

Look under IPv4 Route Table. Windows displays the destination and subnet mask in separate columns. Together, they describe the prefix.

Network Destination  Netmask          Gateway
0.0.0.0              0.0.0.0          192.168.1.1
192.168.1.0          255.255.255.0    On-link

The first line is the default route. The second is the connected 192.168.1.0/24 network.

On Linux:

ip -4 route

A typical result looks like:

default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 scope link

Linux uses default instead of writing 0.0.0.0/0. The word via identifies the next hop, and dev identifies the interface.

On macOS:

netstat -rn -f inet

The formatting differs, but the same destination, gateway, interface, and metric ideas apply.

Note

Your routing table may contain virtual private network (VPN) routes, virtual machine networks, loopback routes, and several entries created automatically by the operating system. Start by finding only the connected network and default route. You do not need to understand every line yet.

Static and Dynamic Routes

Optional: Role-Specific

On a first reading, remember only that routes can be configured directly or learned from other routers. You do not need to study routing protocols here.

A static route is added manually. It stays the same until an administrator or automation changes it. Static routes are useful when the path is simple and predictable.

A dynamic route is learned from another router through a routing protocol. Dynamic routing lets routers adapt when networks or paths change.

Two names are worth recognizing:

• Open Shortest Path First (OSPF) commonly shares routes inside an organization.
• Border Gateway Protocol (BGP) exchanges reachability information between large networks and forms the routing foundation of the internet.

You do not need to configure either protocol for this guide. They still produce routing-table entries that are selected using the same longest-prefix rule.

How a VPN Changes Routing

Optional: Useful Context

Virtual private network routing is a common troubleshooting case but is not required for the core route-selection model.

When a device connects to a virtual private network (VPN), the VPN software adds a virtual network interface and routing-table entries.

• Split tunnel: Only selected traffic, such as traffic for an organization’s internal systems, goes through the VPN. Other traffic uses the device’s normal network connection.
• Full tunnel: The VPN becomes the default path for regular network traffic, including internet traffic.

The routes added by the VPN determine which traffic uses the tunnel.

Follow the Path With Traceroute

Traceroute shows the routers that respond along a path.

Each IP packet contains a Time to Live (TTL) value. Every router reduces it by at least one. When it reaches zero, the router discards the packet and normally returns an Internet Control Message Protocol (ICMP) Time Exceeded message.

Traceroute uses that behavior deliberately:

1. Send a probe with a TTL of 1 to reveal the first router.
2. Send another with a TTL of 2 to reveal the second.
3. Continue increasing the TTL until the destination answers or the limit is reached.

On Windows:

tracert -d example.com

On Linux or macOS:

traceroute -n example.com

The -d and -n options skip name lookups, which makes the path display faster and keeps the first test focused on routing.

An asterisk does not prove that hop is broken. Some routers forward traffic normally but do not send traceroute replies. If later hops answer, packets clearly passed through the silent hop.

Traceroute also shows the forward path seen by its probes, not necessarily the path replies take back.

Try It Yourself

Optional Practice

These read-only checks reinforce the connected route, default route, and path concepts.

Display your routing table and identify:

• Your connected local network
• Your default route
• The default gateway’s address
• The interface used to reach it

Then run traceroute to example.com.

Compare its first responding hop with your default gateway. They are often the same on a home or lab network, although VPNs and some provider networks can make the result different.

Run the trace twice. Paths and response times can change because routing is dynamic and networks may have several valid paths.

Optional Lab

Add one temporary host route on WINCLIENT and watch it override the default route.

1. Find LINUXBOX’s address with ip -4 addr.

2. Open Command Prompt as administrator on WINCLIENT.

3. Add a /32 route for a documentation-only address, using LINUXBOX as the next hop:

   route add 203.0.113.10 mask 255.255.255.255 <LINUXBOX-address>

4. Confirm the route appears:

   route print 203.0.113.10

5. Start a Wireshark capture with the filter arp or icmp, then run:

   arp -d <LINUXBOX-address>
   ping 203.0.113.10

6. WINCLIENT should send an ARP request for LINUXBOX, not for 203.0.113.10. The packet’s destination IP remains 203.0.113.10, but the local frame goes to the next hop.

7. The ping does not need to succeed. LINUXBOX is not configured to route the packet. The exercise is about seeing which route WINCLIENT selected.

8. Remove the temporary route:

   route delete 203.0.113.10

The route is not persistent, but delete it when finished rather than waiting for a restart.

Further Learning

• Request for Comments (RFC) 1812: Requirements for IPv4 Routers defines longest-prefix route selection and other router behavior.
• Microsoft’s route command reference documents how Windows displays and changes its IPv4 routing table.
• Microsoft’s TRACERT troubleshooting guide explains how TTL and ICMP replies reveal a path.
• Linux ip-route manual page documents Linux route display and management.
• RFC 5737: IPv4 Address Blocks for Documentation defines the example-only address used in the lab.

Main Takeaways

• A routing table lists paths to destination networks through specific interfaces or next-hop routers.
• The most specific matching route is selected. The default route is used when no more specific route matches.
• Traceroute can reveal the routers along a path and where delays or failures may occur.

Continue to Module 7: Network Address Translation (NAT) to see how translation changes addresses as packets cross a network boundary.