GO KALI FREE
BeginnerNetworking

Routing Basics: How Data Travels Across Networks

Understand IP routing fundamentals including routing tables, routing protocols, static and dynamic routing, and how data crosses the internet.

#routing#BGP#OSPF#network layer#IP routing

Tracing Packet Routes Across Networks

When a packet leaves your machine, how does it reach its destination? Understanding routing tables, next-hop selection, and routing protocols is critical for network mapping, troubleshooting latency, and identifying where traffic is being redirected or dropped. This guide covers the routing concepts you need for network analysis and security assessments.

Prerequisites

Understanding of IP addressing, subnetting, and the OSI model Layer 3.

How Routing Works

The Routing Table

Every router maintains a routing table — a database of known networks and the best path to reach them.

ip route show
# default via 192.168.1.1 dev eth0
# 192.168.1.0/24 dev eth0 scope link
# 10.0.0.0/8 via 192.168.2.1 dev eth1

Entries include: destination network, next hop, interface, and metric (cost).

Default Gateway

The default route (0.0.0.0/0) is used when no more specific route matches. For home networks, this is the router connecting to the internet.

Routing Decision Process

  • Packet arrives with destination IP
  • Router searches for most specific matching route (longest prefix match)
  • If found, forward to next hop
  • If not, use default route (if configured)
  • If no default, drop the packet (Destination Unreachable)

    • Static Routing

    Manually configured by an administrator. Best for small networks, stub networks, default routes, and security-sensitive environments.

    # Linux: Add a static route
sudo ip route add 10.0.0.0/24 via 192.168.1.254 dev eth0

# Remove
sudo ip route del 10.0.0.0/24

    Example

    Network A (192.168.1.0/24) connected to B (192.168.2.0/24) connected to C (10.0.0.0/24). Router A needs: ip route add 10.0.0.0/24 via 192.168.2.1

    Dynamic Routing

    Protocols automatically discover topology changes and update routing tables.

    Interior Gateway Protocols (IGP) — Within an organization

    RIP: Distance-vector, hop count metric (max 15), simple but slow, legacy.

    OSPF: Link-state, cost based on bandwidth, fast convergence (seconds), most common enterprise IGP.

    EIGRP: Cisco proprietary hybrid protocol, fast convergence, Cisco-only.

    Exterior Gateway Protocols (EGP) — Between organizations

    BGP (Border Gateway Protocol): Path-vector protocol, the routing protocol of the internet. Uses path attributes, supports complex policies. Over 900,000 routes in the global BGP table.

    Path Selection Criteria

  • **Administrative Distance** — Trustworthiness (lower is better)

    • - Directly connected: 0

    - Static: 1

    - OSPF: 110

    - eBGP: 20 / iBGP: 200

  • **Metric** — Protocol-specific cost (RIP: hops, OSPF: bandwidth, EIGRP: composite)
  • **Longest Prefix Match** — Most specific route wins

    • Data Flow Across the Internet

  • Your computer sends to home router (default gateway)
  • Home router forwards to ISP access router
  • ISP checks BGP routing table
  • Packets cross multiple ISP networks (autonomous systems)
  • Reach destination server's network
  • Server sends response along reverse path
    • traceroute google.com
# 1  192.168.1.1 (home router)
# 2  10.0.0.1 (ISP access)
# 3  72.14.237.1 (ISP backbone)
# 4  142.250.80.46 (Google server)

    Real-World Examples

    Multi-Homed Organization: Company with two internet connections uses BGP to advertise IP ranges through both for redundancy.

    OSPF in Data Centers: Large data centers use OSPF between hundreds of switches. When a server fails, OSPF detects it within seconds.

    BGP Hijacking: A malicious ISP falsely advertises IP ranges, diverting traffic. Route Origin Authorization (ROA) and RPKI help prevent this.

    Common Mistakes

    Forgetting return routes — routing is bidirectional. Using dynamic routing on simple networks (overkill). Misconfiguring administrative distance causing routing loops.

    Best Practices

    Use static routes for simple stable networks. Use OSPF for redundant or changing networks. Use BGP for multi-homed internet. Document routing decisions. Monitor routing tables for unexpected changes. Implement RPKI and BGP filtering.

    Related Tools

    traceroute — Trace packet path. ip route — View/modify routing table. bird — Open-source routing daemon. FRRouting — Routing suite. Wireshark — Analyze routing protocols. bgp.he.net — BGP looking glass.

    Related Articles

  • networking-basics
  • osi-model-explained
  • ports-and-protocols
  • dns-explained
  • firewall-fundamentals

    • Summary

    Routing forwards packets toward destinations across networks. Static routes are manually configured for stable networks. Dynamic protocols like OSPF (interior) and BGP (exterior) adapt to topology changes automatically. The internet relies on BGP connecting thousands of autonomous systems.

    Knowledge Check

  • What information does a routing table contain?
  • What is the default gateway used for?
  • What is the difference between static and dynamic routing?
  • What routing protocol runs the internet backbone?
  • What is the longest prefix match rule?

    • Frequently Asked Questions

    What is routing and why is it important?

    Routing is the process of selecting paths for data packets to travel from source to destination across interconnected networks. Routers examine destination IP addresses and forward packets toward their destination using routing tables. Without routing, devices could only communicate on the same local network — routing enables the entire internet to function.

    What is a routing table?

    A routing table is a database stored on a router or host that lists known networks and the best path to reach each one. Each entry includes a destination network, next-hop address, outgoing interface, and metric. View your local routing table with `ip route show` on Linux.

    What is the difference between static and dynamic routing?

    Static routes are manually configured by an administrator and are best for small, stable networks. Dynamic routing protocols like OSPF and BGP automatically discover topology changes and update routing tables, making them essential for larger or redundant networks. See our [Networking Basics](/articles/networking-basics) article for protocol details.

    What is a default gateway?

    The default gateway is the router that handles traffic destined for networks not explicitly listed in the routing table (0.0.0.0/0). In a home network, this is typically your router connecting you to the internet. When your computer does not know how to reach a destination, it sends packets to the default gateway.

    How does BGP work and why does the internet depend on it?

    BGP (Border Gateway Protocol) is the exterior gateway protocol that connects autonomous systems (ISPs, large organizations) across the internet. It uses path-vector routing with policy-based decision making. The global BGP table contains over 900,000 route entries, making it the backbone of internet connectivity.

    What is OSPF and when is it used?

    OSPF (Open Shortest Path First) is a link-state interior gateway protocol used within a single organization. It calculates the shortest path using bandwidth as the metric and converges within seconds when topology changes occur. OSPF is the most common enterprise IGP for campus and data center networks.

    What is the longest prefix match rule?

    When a router has multiple routes to a destination, it selects the most specific route — the one with the longest subnet mask (highest CIDR prefix). For example, 192.168.1.0/24 beats 192.168.0.0/16 because /24 is more specific. This ensures traffic follows the most precise path available.

    How does traceroute work?

    Traceroute sends packets with incrementing TTL (Time To Live) values. Each router along the path decrements the TTL and sends back an ICMP 'Time Exceeded' message when TTL reaches zero. This reveals each hop in the path. Use `traceroute google.com` on Linux or `tracert` on Windows.

    What is BGP hijacking and how can I prevent it?

    BGP hijacking occurs when an attacker or misconfigured ISP falsely advertises IP address ranges, diverting traffic through malicious networks. Route Origin Authorization (ROA) and RPKI (Resource Public Key Infrastructure) help prevent this by cryptographically validating route announcements. Monitor routing tables for unexpected changes.

    What is the difference between IGP and EGP?

    Interior Gateway Protocols (IGP) like OSPF and EIGRP route within a single organization. Exterior Gateway Protocols (EGP) like BGP route between autonomous systems (different organizations/ISPs). IGPs optimize for speed and convergence, while EGPs prioritize policy and path control.

    How do I view the routing table on Linux?

    Use `ip route show` to display the current routing table on modern Linux systems. The output shows destination networks, gateway addresses, and interfaces. For detailed information, `ip route get <destination>` shows which route would be used for a specific IP.

    What is administrative distance and why does it matter?

    Administrative distance (AD) measures the trustworthiness of a routing source. Lower AD is preferred: directly connected (0), static routes (1), OSPF (110), eBGP (20). When two protocols provide routes to the same destination, the router chooses the one with the lowest AD, preventing routing loops from conflicting sources.