Chapter 13 — Routing: how a packet finds its way

In one sentence

Every machine has a routing table — a list of "to reach this range of addresses, send to that next hop" — and a packet is passed from router to router, each making one local decision, until it arrives.

The problem

Your packet needs to reach a server 8,000 km away. No single machine knows the whole path. How does it get there?

The idea, in plain language

Nobody knows the whole route. Everybody knows the next step.

   You, driving, asking at each junction:
      "Which way to Rome?"  ->  "Take the second exit."
   You don't need the whole route. Just the next turn, repeatedly.

Each router asks one question: given this destination address, which of my interfaces should I send it out of? Then it's someone else's problem.

How it actually works: the routing table

Look at yours right now:

ip route              # Linux
netstat -rn           # macOS / BSD
route print           # Windows

You'll see something like:

default via 192.168.1.1 dev wlan0
192.168.1.0/24 dev wlan0 proto kernel scope link src 192.168.1.50

Read each line as: "To reach this destination, send it this way."

Line	Means
`192.168.1.0/24 dev wlan0 ... src 192.168.1.50`	"Addresses in 192.168.1.x are on my own Wi-Fi network — send directly (ARP for them)."
`default via 192.168.1.1 dev wlan0`	"Anything else, hand to 192.168.1.1 and let it worry."

default means 0.0.0.0/0 — "every possible address". It's the catch-all, and it's why your home network needs only two rules to reach the entire internet.

The one rule: longest prefix match

If several routes match, the most specific one wins — the one with the biggest /number.

   A packet for 10.1.2.3 arrives. The table contains:

      0.0.0.0/0        <- matches (matches everything)
      10.0.0.0/8       <- matches
      10.1.0.0/16      <- matches
      10.1.2.0/24      <- matches   <=== WINNER (most specific)

   The /24 route is chosen, regardless of the order they're listed in.

Think of it as "the most specific instruction wins", like a company policy where a department rule overrides the company-wide rule.

What a router does to each packet

   1. Check the packet isn't corrupt (header checksum)
   2. Decrement the TTL ("hop counter"). If it hits 0: DROP it and
      send an error back  (this is what makes traceroute possible -- Ch 14)
   3. Look up the destination IP -> longest prefix match -> next hop + interface
   4. Rewrite the LINK-LAYER header (new source/destination MAC for the next hop)
   5. Send it

Note step 4: the MAC addresses change at every hop; the IP addresses don't. That's the Chapter 2 insight, made concrete. And note what a router does not do: it keeps no memory of your connection, doesn't retransmit, doesn't look inside. That's the end-to-end principle (Chapter 3).

How routers learn routes

Source	How	Where
Directly connected	"I have an interface on this network"	automatic
Static	A human types `ip route add ...`	small networks, home
OSPF / IS-IS	Routers inside one organisation flood each other with link info and each computes shortest paths	company networks
BGP	Routers between organisations exchange "I can reach these address ranges via this path"	this is what runs the internet

BGP deserves a note: there are ~75,000 independent networks (called autonomous systems) on the internet, and BGP is how they tell each other which addresses they can reach. It's held together by trust and business agreements more than by technology, which is why occasional BGP mistakes take large parts of the internet offline.

Practice (30 min)

A. Read your own routing table and explain each line out loud.

ip route          # or: netstat -rn

B. Ask your machine to decide (Linux — this is a great tool):

ip route get 8.8.8.8
ip route get 192.168.1.99      # substitute an address on your own network
ip route get 127.0.0.1

It prints exactly which route it chose, which interface, and which source address. Compare all three answers — one goes via the gateway, one goes direct, one stays local.

C. See the hops for real:

traceroute -n example.com          # macOS/Linux
tracert example.com                # Windows
mtr -rwzbc 50 example.com          # better: continuous, shows loss per hop

Each line is one router along the path. Chapter 14 explains exactly how this works and — importantly — how to read it without being misled.

D. Watch TTL decrease. Ping something far away and look at the TTL in the reply:

ping -c 1 example.com
# "64 bytes from ...: icmp_seq=0 ttl=52 time=91 ms"

Most systems start TTL at 64. A reply arriving with ttl=52 means it crossed about 64 − 52 = 12 routers on the way back.

Common confusions

"Default gateway vs router?" The default gateway is the router your machine sends everything unknown to. Same box, different role name.
"Does the router know the whole path?" No. It knows one step. This is the central idea of the chapter.
"Why does traceroute show different paths each run?" Load balancing across multiple equal-cost links (ECMP). Normal.
"Can the path back be different from the path there?" Yes, and it usually is. This is called asymmetric routing and it confuses both humans and firewalls.

Check yourself

What does default via 192.168.1.1 mean?
Given routes 10.0.0.0/8 and 10.1.2.0/24, which is used for 10.1.2.50?
What does a router change in the packet, and what does it leave alone?
What is BGP for?