How Routing Works: Packet Paths and Decisions

When a packet arrives at a router, the router does not simply “look up the destination” and send it on its way. The process is a series of decisions, each of which can fail. Understanding those decisions explains why a packet can leave a host, travel through several routers, and then vanish without a trace.

This page explains the mechanism of IP routing. It is not a troubleshooting guide, but the principles here let you predict what a router will do with any packet, including the ones that never come back.

The Routing Table: More Than a List

Every router (and every host with IP networking enabled) maintains a routing table. On Windows, the table is visible with route print; on Linux, ip route. The table is not a flat list of every possible destination. It is a set of entries, each of which says: “To reach a certain network, send the packet to this next hop, using this interface.”

Each entry has three critical parts:

• Prefix: the destination network, written in CIDR notation (e.g., 192.168.1.0/24).
• Next hop: the IP address of the next router to receive the packet, or a local interface if the destination is directly connected.
• Metric / cost: a number used to choose between multiple routes to the same network. Lower is preferred.

A typical routing table on a home router or a Windows PC contains a few direct routes (the local subnets) and a default route. The default route is the entry for 0.0.0.0/0, which matches every possible destination. It is the “catch-all” that sends packets to the upstream router (often the ISP’s gateway).

The Decision: Longest-Prefix Match

When a packet arrives, the router examines the destination IP address and searches its routing table for the entry that matches the most specific prefix. This is called longest-prefix match (LPM).

The prefix length (the /24 or /16 part) indicates how many bits of the destination address must match. A /24 requires the first 24 bits to match; a /16 requires the first 16. The router compares the destination address against each entry’s prefix and selects the one with the longest matching prefix length. If two entries have the same prefix length, the one with the lower metric wins.

For example, consider a router with these entries:

• 192.168.1.0/24 via 192.168.1.1 (local interface)
• 192.168.0.0/16 via 10.0.0.1
• 0.0.0.0/0 via 203.0.113.1 (default)

A packet destined for 192.168.1.50 matches all three entries: it is within the /24, within the /16, and within the default. Longest-prefix match selects the /24 entry because it has the longest prefix (24 bits). The packet is sent directly to the local network. A packet destined for 192.168.2.10 matches the /16 and the default, but not the /24; the /16 wins. A packet to 8.8.8.8 matches only the default, so it goes to the ISP gateway.

This mechanism is what allows a router to have a default route that handles all traffic not otherwise specified, while still sending local traffic directly. It also means that a more specific route always overrides a less specific one, regardless of metric. A route to 10.0.0.0/8 with a metric of 100 will be preferred over a default route with a metric of 1 for any destination in the 10.0.0.0/8 range.

Step by Step: What a Router Does

The forwarding process, in order:

1. Receive the packet on an interface. The router checks the frame’s destination MAC address. If it matches the interface’s MAC (or is a broadcast), the router accepts the frame and extracts the IP packet.
2. Validate the IP header (checksum, version, etc.). Corrupt packets are dropped.
3. Decrement the TTL (Time to Live). If the TTL reaches zero, the router discards the packet and sends an ICMP Time Exceeded message back to the source. This is the mechanism that prevents packets from looping forever.
4. Look up the destination IP in the routing table using longest-prefix match. If no route matches (no default route exists), the router drops the packet and sends an ICMP Destination Unreachable (Network Unreachable) message.
5. Determine the next hop and outgoing interface. If the next hop is on a directly connected network, the router uses ARP (IPv4) or NDP (IPv6) to find the next hop’s MAC address. If the next hop is not directly connected, the router must have a route to reach that next hop (which is usually a more specific route or the default).
6. Rewrite the frame: the source MAC becomes the outgoing interface’s MAC, the destination MAC becomes the next hop’s MAC (or the final destination’s MAC if the destination is on the same network). The IP packet itself is unchanged except for the TTL.
7. Transmit the packet on the outgoing interface.

Each router along the path repeats these steps. The packet’s IP source and destination addresses never change; only the MAC addresses change at each hop.

Why a Packet Can Leave and Never Come Back

Several failure points in the above process can cause a packet to be sent out but never return. The most common is asymmetric routing: the packet takes one path to the destination, but the reply takes a different path, and one of those paths has a routing problem. For example, a packet may leave your network via a default route, but the destination’s reply may be sent to a different IP (perhaps because the source address was translated by NAT), and the return path may have no route back.

Another cause is a missing route on an intermediate router. If a router along the path has no default route and no specific route for the destination, it will drop the packet and send an ICMP Destination Unreachable. That ICMP message may itself be blocked by a firewall, so the source never learns of the failure.

A third cause is a TTL that expires. If the path has too many hops (more than the TTL allows), the packet is discarded. This is rare on the modern internet because the default TTL is 64, but misconfigured routers or routing loops can cause it.

Finally, a router may have a route but the next hop may be unreachable. The router will attempt to send the packet, but if the next hop’s MAC address cannot be resolved (ARP failure) or the next hop is down, the packet is dropped. The router may or may not send an ICMP error, depending on its configuration.

The Default Route: Your Safety Net

The default route (0.0.0.0/0) is the most important entry in any routing table. It is the route of last resort. Without it, any packet destined for a network not explicitly listed is dropped immediately. On a host, the default route is usually set to the local router’s IP. On a router, it is set to the upstream provider’s gateway.

The default route is also the source of many routing problems. If it is missing, misconfigured, or points to an unreachable next hop, all off-network traffic fails. Conversely, if a more specific route is wrong, it can override the default and send traffic to the wrong place.

Routing vs. Forwarding: A Common Confusion

Routing is the process of building the routing table (via static configuration or dynamic protocols like OSPF, BGP, RIP). Forwarding is the process of using the table to move a packet. This page has focused on forwarding. The distinction matters because a router can have a correct forwarding mechanism but a broken routing table (e.g., a missing route), or a correct table but a broken forwarding path (e.g., a faulty interface).

What People Get Wrong About Routing

A natural mistake is to think that a router must know a route to the destination host. In fact, a router only needs a route to the network that contains the host. The last router on the path (the one directly connected to the destination’s network) is responsible for delivering the packet to the host via ARP. This is why you can have a route to 10.0.0.0/8 and reach any host within that range, even if you have never heard of that specific host.

Another common misconception is that the default route is a “backup” that is only used if no other route matches. That is true, but it is also the route that carries almost all internet traffic. The default route is not a fallback; it is the primary route for anything not local.

A third mistake is to assume that if a packet is sent, it will be delivered. The internet is a best-effort network. Routers drop packets for many reasons: congestion (buffer overflow), TTL expiry, or a missing route. TCP handles this by retransmitting, but UDP does not. The routing mechanism itself does not guarantee delivery.

Comparison of Routing Concepts

Commands to Inspect Routing

On Windows, to see the routing table:

route print

This shows the IPv4 and IPv6 routing tables. The output includes the destination network, netmask, gateway, interface, and metric. The default route appears as 0.0.0.0 with a netmask of 0.0.0.0.

To add a static route (requires administrator privileges):

route add <destination> mask <netmask> <gateway>

For example, to route traffic for 192.168.2.0/24 via 192.168.1.254:

route add 192.168.2.0 mask 255.255.255.0 192.168.1.254

To delete a route:

route delete <destination>

On Linux, the equivalent commands are ip route show, ip route add, and ip route del. The syntax differs; consult the ip command’s documentation.

These commands are for inspection and static configuration. Dynamic routing protocols (RIP, OSPF, BGP) are beyond the scope of this page, but they ultimately populate the same routing table that the forwarding process uses.

The Role of the Host

A host (your PC) also performs routing. When you send a packet to a remote destination, the host checks its own routing table. If the destination is on a directly connected network, it sends the packet directly (using ARP). Otherwise, it sends the packet to the default gateway. The host does not need to know the entire path; it only needs to know the first hop. This is the same principle that allows the internet to scale: no single router knows the whole path.

Understanding this mechanism allows you to predict that, for example, if you add a static route on your PC to send traffic for a specific network to a different gateway, that traffic will follow that route, regardless of what the default gateway would have done. It also explains why a misconfigured route on your PC can break connectivity to a whole range of addresses, even though the rest of the network is fine.

When Routing Fails: A Mechanism View

If a packet is not reaching its destination, the cause is one of the following:

• No route to the destination (check the routing table on each router along the path).
• A route exists but the next hop is unreachable (check ARP, interface status).
• The TTL expires (check for loops, count hops with tracert).
• A firewall drops the packet (not a routing issue, but often mistaken for one).

Diagnosing routing problems involves examining the routing table at each hop and using tools like tracert (Windows) or traceroute (Linux) to see where the packet stops. But the mechanism described here is the foundation for those diagnostics.