Routing, Routing Tables and Default Routes

Why routing exists

Ethernet delivers a frame on one local Layer 2 domain. Routing moves an IP packet between Layer 3 networks. A host sends an off-link packet to a router, and each router independently chooses where that packet should go next. A route is a forwarding instruction, not a record of the whole end-to-end journey.

Route-table anatomy

A useful route entry names a destination prefix, a route source, an outgoing interface, and—when another router must receive the packet—a next-hop address. It can also carry an administrative distance and metric. Read the entry as: “For destinations inside this prefix, use this interface and, if present, send toward this next hop.”

Connected, static, learned, and default routes

• A connected route appears because the router has an active interface in that network.
• A static route is configured deliberately by an administrator.
• A learned route arrives through a routing protocol.
• A default route (0.0.0.0/0 or ::/0) is the least-specific match and is used only when no more-specific route wins.

The source explains how the router learned the route; it does not override longest-prefix matching.

How prefix matching works

The router first keeps routes from the destination's address family, then checks whether the destination bits match each route prefix. An IPv4 destination is never evaluated against an IPv6 route, and an IPv6 destination is never evaluated against an IPv4 route.

Interactive route selection

Change the scenario and watch the same decision order: address family, prefix match, longest prefix, administrative distance, comparable metric, then forwarding result. Rejected rows remain visible so the reason is inspectable.

Longest-prefix match

Among matching routes, the route with the greatest prefix length is most specific and wins. A /32 IPv4 or /128 IPv6 host route beats a shorter network route, and either beats a /0 default. The router does not prefer a default merely because it is static.

Administrative distance

If multiple route sources offer the same prefix length, administrative distance expresses the local router's preference for those sources. Lower is preferred. Administrative distance is locally significant and vendor defaults can differ, so compare it only after family, matching, and prefix length.

Route metric

If routes to the same prefix remain tied within a comparable routing source, its metric chooses the preferred path; lower commonly wins. Metrics from different protocols may measure different things and should not be compared as if they shared one scale. Equal-cost routes can support ECMP, previewed here without covering platform-specific load sharing.

Next hop and outgoing interface

The outgoing interface identifies the link the packet will leave. The next hop identifies the adjacent router that should receive it. A directly connected route may need only an interface because the destination itself is on that link. Before transmission, the router resolves the Layer 2 address needed on that outgoing link.

Interactive hop-by-hop forwarding

Follow successful and failed journeys. At every routed hop, the destination IP address does not change, the Layer 2 header is replaced for the new link, and the IPv4 TTL or IPv6 Hop Limit decreases exactly once. Each router performs a fresh lookup in its own routing table.

IPv4 and IPv6 routing

IPv4 and IPv6 use separate route families but the foundational selection method is the same: match the destination, prefer the longest prefix, then resolve genuine ties using route preference and a comparable metric. IPv4 decrements TTL; IPv6 decrements Hop Limit. Their neighbour-resolution and control-message details differ.

No route and packet disposal

If no specific route and no usable default route match, there is no usable route: the router cannot forward the packet and discards it. It may generate ICMP Destination Unreachable for IPv4 or ICMPv6 Destination Unreachable for IPv6, but policy, rate limiting, reachability, or filtering can prevent that response. Silence alone does not prove the discard reason.

Inspect routing evidence

On Windows, compare route print with Get-NetRoute; verify the address family, destination prefix, next hop, interface index, and metric. On Linux, use ip route for IPv4 and ip -6 route for IPv6. On a representative network device, use commands such as show ip route and show ipv6 route, then inspect the legend before interpreting route-source codes.

Capture traffic in Wireshark while testing a known path. Confirm that the IP destination remains the final endpoint while Ethernet source and destination addresses change at each routed link. A reduced IPv4 TTL or IPv6 Hop Limit is forwarding evidence. ICMP or ICMPv6 errors are useful evidence when present, but their absence is not proof that no router discarded the packet.

Guided routing practice

For each destination, write the candidates in this order: correct address family, matching prefixes, longest prefix, lowest administrative distance among equal prefixes, and lowest comparable metric if a genuine tie remains. Then state the outgoing interface, next hop, expected Layer 2 target, and whether TTL or Hop Limit permits forwarding.

Troubleshoot routing methodically

1. Confirm the destination address and whether the packet is IPv4 or IPv6.
2. Verify that at least one prefix matches, including a usable default if required.
3. Apply longest-prefix match before comparing route sources.
4. For equal prefixes, check administrative distance; compare metrics only when they are genuinely comparable.
5. Verify the selected outgoing interface is operational and the next hop is reachable on that link.
6. Inspect ARP or NDP evidence for next-hop Layer 2 resolution.
7. Check TTL or Hop Limit and identify the router responsible for any discard.
8. Correlate packet evidence with conditional ICMP or ICMPv6 messages and filtering policy.

Knowledge check and summary

Pro deep dive