1st Principles
Menu

Networking · 32 min read

Routing and Forwarding

How packets find a path: local forwarding decisions at each hop, guided by routes learned or configured across independently operated networks.

Why this exists

Addresses alone do not move packets. Each router must answer a local question: given this destination, which next hop should I use?

Routing is how those answers are computed and distributed. Forwarding is the per-packet lookup that uses the answer. Split correctly, the internet can be a patchwork of independently run networks that still deliver end to end.

Without this split, every change in topology would require rewriting packets with full paths, or running the entire internet as one administratively flat fabric. Neither scales to the real world of competing ISPs and enterprises.

Axioms & primitives

  1. 01Forwarding is the per-packet decision: longest-prefix match to a next hop.
  2. 02Routing is the control plane that builds and updates forwarding tables.
  3. 03Each hop only needs a good next hop, not the full path in the packet.
  4. 04Autonomous systems exchange reachability; policy shapes which routes are preferred.
  5. 05Loops and black holes are failure modes of inconsistent or incomplete routing state.
  6. 06A default route is an explicit claim: 'send everything I do not know more specifically upstream.'

Learning objectives

After this lesson you should be able to:

  • Distinguish routing (control plane) from forwarding (data plane) in one clear sentence each.
  • Explain longest-prefix match with a small example table.
  • Describe why TTL/hop limit exists and what traceroute observes.
  • Sketch how a default route at a home router differs from BGP between ISPs at a conceptual level.
  • Diagnose whether a symptom sounds like a black hole, a loop, or a policy drop.

Progressive depth

Read the layers in order for a full explanation. Or open the layer you need.

01

Intuition

A packet arrives on one interface. The router asks: where should this go next? It does not open a TCP connection to the destination. It looks up the destination IP in a table and shoves the packet out another interface toward a neighbor that is supposedly closer.

That hop-by-hop handoff is forwarding. The table itself must come from somewhere: static configuration, interior protocols inside an organization, or exterior protocols between organizations.

Your home router mostly needs one smart idea: a default route to the ISP. The ISP and the rest of the internet need many smarter ideas so that prefixes find paths around failures and policies.

02

Formal shape

Forwarding uses longest-prefix match: among all prefixes covering the destination, pick the most specific, then send to its next hop and outgoing interface. Hardware datapaths do this at enormous rates.

TTL (IPv4) or hop limit (IPv6) decrements each hop; at zero the packet dies and often triggers an ICMP time-exceeded message (what traceroute listens for). This bounds damage from loops.

Inside a network, OSPF/IS-IS style protocols flood topology and compute shortest paths. Between autonomous systems, BGP exchanges prefixes with rich policy. Defaults (0.0.0.0/0, ::/0) send "everything else" upstream, which is how home routers work.

ECMP (equal-cost multipath) installs multiple next hops for the same prefix and hashes flows across them. The control plane still calls it one prefix; the data plane sprays.

Hop-by-hop default path

Click a stage to see the home-to-ISP handoff this page uses to explain forwarding.

Loading diagram...

Select a stage to read the boundary detail.

03

Worked examples

Home: your laptop's default gateway is the router. The router has a default toward the ISP. The ISP has routes to the rest of the internet. Most consumer troubleshooting is 'is the default gateway reachable?' then 'does the ISP route work?'

Datacenter: leaf-spine fabrics use ECMP to spray flows across many links. One failed link shifts hashing. Applications that pin identity to a 5-tuple path can see weird affinity changes.

Failure: withdraw a prefix and traffic shifts. If two routers disagree mid-convergence, you can get loops until TTL kills the packet. Users see timeouts, not a polite error page.

Longest-prefix example: prefixes 10.0.0.0/8 via A, 10.1.0.0/16 via B, 0.0.0.0/0 via C. Destination 10.1.2.3 matches all three covers, but /16 is longest, so next hop B wins.

04

Edge cases

Anycast and ECMP make "the path" plural. Asymmetric routing (forward and reverse take different paths) is common and breaks naive stateful middleboxes that only see one direction.

Policy can prefer a longer path for business reasons. Blackholing can be intentional (DDoS response) or accidental (misconfiguration). Source address spoofing is a forwarding-plane abuse when ingress filtering is missing.

Default routes can hide mistakes: a wrong static route may still "go somewhere" until you notice it is the wrong somewhere. More-specific wrong routes are even sharper knives.

Traceroute lies in useful ways: ICMP rate limits, tunnels, MPLS, and firewalls create stars and long pauses that are not literal geography.

Mental models

  • Highway exit signs

    You do not need a national map at every mile. You need the correct next exit. Routers are exit-sign readers.

  • Control tower vs runway

    Routing is the plan (control tower). Forwarding is the takeoff (runway operations) happening continuously.

  • Gossip of reachability

    Networks tell neighbors what they can reach. Prefer the better story under policy, then install it in the forwarding table.

  • Library of maps, not one GPS track

    Each AS holds its own map. Consistency is approximate and eventually repaired, not globally locked.

Common misconceptions

  • Myth

    The packet carries a full turn-by-turn path like GPS.

    Reality

    Usually the packet carries a destination address. Each router decides the next hop independently using its table.

  • Myth

    Routing and forwarding are synonyms.

    Reality

    Routing builds knowledge; forwarding uses it at line rate. Confusing them hides where bugs live.

  • Myth

    If traceroute shows a path, that path is permanent.

    Reality

    Routes change with failures, policy, and load. Traceroute is a snapshot, and some hops may not reply.

  • Myth

    The shortest path in hops is always best.

    Reality

    Policy, cost, capacity, and risk often prefer a longer path. BGP is not pure shortest-path math.

Exercises

Work these without looking up answers first. Check yourself against the intent notes.

  1. Exercise 01

    Given prefixes 10.0.0.0/8 via A, 10.1.0.0/16 via B, and 0.0.0.0/0 via C, where does 10.1.2.3 go and why?

    What good looks like

    Longest prefix: 10.1.0.0/16 via B.

  2. Exercise 02

    A packet loops between two routers until it disappears. Which field caused it to disappear, and what operational problem likely created the loop?

    What good looks like

    TTL/hop limit; inconsistent routing state / convergence / misconfig.

  3. Exercise 03

    A home user can ping 8.8.8.8 but cannot resolve names. Is that primarily a forwarding failure to the internet? What else should they check?

    What good looks like

    Forwarding to some IPs works; DNS resolver reachability/config is the likely gap. Not every 'internet broken' is routing.

Sources & further reading

External references. Prefer primary documents and clear explainers.

Go deeper on your own

These picks go past the foundation in this lesson. Use them when you want a primary spec, official docs, or a longer walkthrough.