CCNA online course

IP Routing Explained: How Routers Forward Packets

Learn how IPv4 routing works, including default gateways, routing tables, longest-prefix match, next hops, Cisco IOS verification, and common routing failures.

IP routing is the Layer 3 process of selecting a path and forwarding IP packets between different networks. Hosts use local delivery when the destination is in the same subnet. For a remote destination, the host sends the packet to a router, usually through its configured default gateway.

This lesson assumes familiarity with IPv4 addresses, subnet masks, CIDR notation, Ethernet frames, MAC addresses, and ARP. For a broader view of protocol layers, see the OSI Reference Model.

Why IP Routing Is Necessary

An IPv4 network is identified by a prefix such as 192.168.10.0/24. A host uses its subnet mask to determine whether a destination is local or remote.

• Local-network delivery: The source and destination are in the same subnet. The source uses ARP to learn the destination's MAC address and sends an Ethernet frame directly to that host.
• Remote-network delivery: The destination is in a different subnet. The source sends the frame to a Layer 3 device, normally its default gateway.

Hosts in different IP networks cannot communicate directly using ordinary local Ethernet delivery. A router connects separate networks and separate broadcast domains. It examines the destination IP address, consults its routing table, and chooses where to forward the packet next.

Routers do not forward Layer 2 broadcasts by default. A broadcast received on one router interface normally stops at that interface, which prevents a single broadcast domain from extending across every routed network.

Local Delivery and Remote Delivery

Consider PC-A at 192.168.10.10/24 and PC-B at 192.168.20.10/24. PC-A calculates that 192.168.20.10 is outside its local 192.168.10.0/24 subnet. PC-A therefore does not ARP for PC-B. Instead, it ARPs for the MAC address of its default gateway, 192.168.10.1.

If the destination were 192.168.10.20, PC-A would ARP for PC-B and send the frame directly. The default gateway is used only when the destination is outside the host's local subnet.

How a Router Forwards an IPv4 Packet

1. The source host compares the destination IP address with its own address and subnet mask.
2. If the destination is remote, the host selects its default gateway and places the IP packet inside an Ethernet frame addressed to the gateway's MAC address.
3. The router receives the frame on an active interface and verifies that the frame is valid for that interface.
4. The router removes, or decapsulates, the incoming Layer 2 header and trailer. The IP packet remains.
5. The router looks up the packet's destination IP address in its IPv4 routing table.
6. The router selects an outbound interface and, when required, a next-hop IP address.
7. On Ethernet, the router uses ARP to resolve the next-hop IP address to a MAC address if it does not already know the mapping.
8. The router creates a new Layer 2 frame for the next link and sends the unchanged-or-updated IP packet inside it.

During ordinary routing, the source and destination IP addresses normally remain the same from the originating host to the destination host. The Layer 2 source and destination MAC addresses change on every routed Ethernet segment.

At each IPv4 router hop, the router decrements TTL by one. TTL, or Time To Live, prevents a packet from looping forever. Because the IPv4 header changes when TTL changes, the router recalculates the IPv4 header checksum. If TTL reaches zero, the router discards the packet and commonly sends an ICMP time-exceeded message.

Routing Table Fundamentals

A routing table is a database of known destination prefixes and the information needed to reach them. A route identifies a destination network and a forwarding path. Routes can be created from active interfaces, administrator configuration, or routing protocols.

Common Route Types

A connected route appears when an interface has an IPv4 address and is operational. A local route represents the router's own interface address, not the entire attached subnet. A static route is manually configured. Dynamic routing automatically exchanges and learns routes through a routing protocol.

Interior routing protocols exchange routes within an organization's routing domain. Examples include OSPF, RIP, and EIGRP. Routes learned from outside the organization or routing domain are generally described as externally learned routes; the exact behavior depends on the protocol and design.

Route Selection Logic

The router first asks which routes match the destination IP address. It does not simply choose the first entry displayed in the table. The primary rule is longest-prefix match: select the matching route with the greatest prefix length.

For example, given these routes:

10.0.0.0/8       via 192.0.2.2
10.20.0.0/16     via 192.0.2.3
10.20.30.0/24   via 192.0.2.4
0.0.0.0/0        via 192.0.2.1

• 10.20.30.50 uses the /24 route.
• 10.20.40.50 uses the /16 route.
• 10.99.1.1 uses the /8 route.
• 203.0.113.10 uses the default route.

Administrative distance is a local trust value. When equivalent prefixes are learned from different sources, the lower AD is preferred. For example, a connected route normally defeats a static or dynamic route to the same prefix. A metric is a path-cost value used to compare candidate routes from the same routing source or protocol. Do not compare metrics before determining the matching prefix and route-source preference.

ECMP, or Equal-Cost Multipath, allows a router to install and use multiple paths when they are equally preferred according to the routing source. Traffic distribution behavior depends on platform and forwarding configuration.

Default Routes and Floating Static Routes

A default route is the least-specific IPv4 route, written as 0.0.0.0/0. It matches every IPv4 destination, but any more specific route wins first. When installed, it is called the gateway of last resort.

ip route 0.0.0.0 0.0.0.0 192.0.2.2

A branch router with one upstream path commonly uses a default route to forward unknown destinations. Internal routes with longer prefixes still override it.

A floating static route is a backup static route with a deliberately higher administrative distance:

ip route 192.168.20.0 255.255.255.0 192.0.2.6 200

The backup is not selected while a preferred route to the same destination is active. It can become active when the preferred route disappears.

Next Hops, Exit Interfaces, and Recursive Lookup

A route can specify an exit interface, a next-hop IP address, or both. The exit interface identifies where to send the packet. The next hop identifies the next Layer 3 device on that path.

When a route points to a next-hop address, the router may perform a recursive lookup: it looks up the next-hop IP address to determine which interface and Layer 2 resolution method should be used. The next hop must itself be reachable through a valid route.

On an Ethernet link, ARP maps the next-hop IPv4 address to a MAC address. The router then builds a frame addressed to that MAC. On a point-to-point link, such as a serial or other point-to-point connection, an exit interface may be sufficient because there is only one possible neighbor on the link.

Routing Versus Switching

A switch learns source MAC addresses and uses its MAC address table to select a switch port. A router uses a routing table to select a Layer 3 path. A multilayer switch can perform both functions, but the lookup concepts remain distinct.

End-to-End Example: Two LANs Through Routers

Use this topology:

PC-A 192.168.10.10/24 -- R1 G0/0 192.168.10.1/24
                                  R1 G0/1 192.0.2.1/30 -- R2 G0/0 192.0.2.2/30
                                                           R2 G0/1 192.168.20.1/24 -- PC-B 192.168.20.10/24

PC-A's default gateway is 192.168.10.1. PC-B's default gateway is 192.168.20.1. R1 needs a route to 192.168.20.0/24, and R2 needs a route to 192.168.10.0/24.

1. PC-A determines that PC-B is remote because 192.168.20.10 is not in 192.168.10.0/24.
2. PC-A uses ARP to learn R1's MAC address at 192.168.10.1.
3. PC-A sends a frame with source MAC PC-A and destination MAC R1 G0/0. The packet has source IP 192.168.10.10 and destination IP 192.168.20.10.
4. R1 removes the Ethernet header, decrements TTL, recalculates the IPv4 checksum, and matches 192.168.20.0/24.
5. R1 forwards toward R2 over 192.0.2.0/30. It ARPs for 192.0.2.2 if necessary, then creates a new Ethernet frame with R1 G0/1 as the source MAC and R2 G0/0 as the destination MAC.
6. R2 repeats the process, matches its connected 192.168.20.0/24 route, and ARPs for PC-B's MAC address.
7. R2 sends a new frame to PC-B. The final frame's source MAC is R2 G0/1 and its destination MAC is PC-B. The endpoint IP addresses are still PC-A and PC-B, while TTL is lower than when the packet started.

The return path is equally important. PC-B sends replies to its default gateway, R2. R2 needs a route to 192.168.10.0/24, and R1 must be able to deliver the reply to PC-A. A working forward route alone does not guarantee a successful ping or application session.

Basic Cisco IOS Verification

Use these commands from privileged EXEC mode to inspect interfaces, routes, neighbor resolution, and forwarding decisions:

show ip interface brief
show interfaces
show ip route
show ip route connected
show ip route static
show ip route 192.168.20.0
show arp
show ip cef 192.168.20.10
ping 192.168.20.10
traceroute 192.168.20.10

show ip interface brief gives a concise view of interface addresses and operational states. An interface should normally show an IP address and up/up status before its connected route is installed. show interfaces provides detailed physical, data-link, error, and configuration information.

show ip route displays route codes and entries. Common Cisco IOS codes include C for connected, L for local, S for static, and O for OSPF. An entry such as O 192.168.20.0/24 [110/2] via 192.0.2.2 indicates an OSPF route, a prefix of /24, administrative distance 110, metric 2, and next hop 192.0.2.2. The output also identifies the elapsed time and outbound interface where applicable.

show ip route 192.168.20.0 performs a destination-focused inspection. show arp checks IPv4-to-MAC mappings on Ethernet. show ip cef displays the Cisco Express Forwarding result for a destination. ping tests reachability, while traceroute reveals the Layer 3 hops that respond along the path.

Basic Cisco IOS Configuration

configure terminal
interface gigabitEthernet0/0
 ip address 192.168.10.1 255.255.255.0
 no shutdown
exit
ip route 192.168.20.0 255.255.255.0 192.0.2.2
ip route 0.0.0.0 0.0.0.0 192.0.2.2

The interface configuration supplies the address for a connected network. The static route supplies a path to a remote network, and the default route supplies a path for otherwise unknown destinations. For dynamic path learning, see Configure OSPF.

Common Routing Failures

Layer 2 failure can prevent forwarding even when the IP route is valid. For Ethernet next hops, check ARP resolution, VLAN membership, interface state, and the link itself. A route is a forwarding instruction; it does not prove that the next-hop device can actually be reached.

Exam-Relevant Summary

• A host uses its default gateway only for destinations outside its local subnet.
• Routers make forwarding decisions using destination IP addresses and routing tables.
• Longest-prefix match is applied before comparing route-source preference and metrics.
• Lower administrative distance is preferred between equivalent prefixes learned from different sources.
• Metrics compare paths within the same routing source or protocol.
• Source and destination IP addresses normally remain unchanged during ordinary routing; Layer 2 addresses change at every hop.
• Routers decrement IPv4 TTL and recalculate the IPv4 header checksum.
• A default route is 0.0.0.0/0 and is used only when no more specific route matches.
• Successful communication requires a usable route in both directions.

Routing connects IP networks, while switching delivers frames within a Layer 2 domain. Understanding the distinction between these operations makes default gateways, routing tables, ARP, route selection, and troubleshooting much easier to reason about.