Routing: how a router chooses a path

It decrements the TTL and rebuilds the layer 2 frame entirely; the source and destination IP addresses do not change.

• The old frame header is discarded and a new one built with this router's outgoing MAC as source and the next hop's as destination.
• The frame checksum is recalculated because the frame is new.
• The IP header checksum is also recalculated, since the TTL changed.

NAT is the exception that proves the rule: it is precisely a device that does change the IP addresses, and everything that assumes they are stable has to be worked around.

When several routes match a destination, the one with the most network bits is chosen, regardless of source or metric.

• For 10.1.1.50, a /30 covering it beats a /24, which beats a /16, which beats the default route.
• This lets a default route coexist safely with any number of specific routes.
• It also means adding a more specific route redirects a subset of traffic without touching anything else.

Providers exploit it deliberately: advertising a longer prefix attracts traffic away from a shorter one, which is the basis of both traffic engineering and prefix-hijacking incidents.

Administrative distance is a trust rating per route source, used to choose between the same prefix learned from different sources; a metric compares paths within a single source.

• Lower distance wins: connected 0, static 1, eBGP 20, EIGRP 90, OSPF 110, RIP 120.
• Metrics from different protocols measure different things and cannot be compared.
• Distance is evaluated only after longest prefix match has already narrowed the candidates.

It exists because there is no meaningful way to compare an OSPF cost of 20 with an EIGRP metric in the tens of thousands — a human judgement about trust has to stand in.

C is the connected subnet as a whole; L is the router's own address on that subnet, installed as a /32.

• The C entry tells the router how to reach any host on that network.
• The L entry lets the router recognise packets addressed to itself rather than forwarding them.
• Both disappear if the interface goes down.

The local /32 was added in later IOS versions; before it, the router matched its own address through the connected route, which made some corner cases in policy routing ambiguous.

Because the router treats every destination in that prefix as directly attached and ARPs for each one individually, instead of ARPing once for a next hop.

• On a point-to-point serial link this is harmless, since there is only one possible receiver.
• On Ethernet it depends on the neighbour running proxy ARP, which may be disabled.
• Even when it works, the ARP cache grows with the number of destinations rather than the number of neighbours.

Specifying both the interface and the next hop is the safest form, because it avoids the recursive lookup as well as the ARP behaviour.

A static route configured with an administrative distance higher than the primary source, so it stays out of the routing table until the primary route disappears.

• Backing up an OSPF route with distance 110 means giving the static a distance above that, such as 200.
• It is invisible in show ip route while the primary is present.
• It is the standard way to arrange a backup WAN or broadband link without running a protocol over it.

Its weakness is that it only reacts to the route disappearing, so a link that stays up while failing to pass traffic will not trigger it — which is what IP SLA tracking is added for.

A route to 0.0.0.0/0, which matches every destination; it is safe because its zero-length prefix loses to every other matching route.

• It is used only when nothing more specific matches, hence "gateway of last resort".
• A branch office with one exit needs nothing else in its table.
• It can be static, or advertised by a routing protocol from the router that owns the exit.

Its danger is diagnostic rather than functional: with a default route present, a missing specific route does not fail loudly — traffic simply goes the wrong way and reaches something unhelpful.

A missing or wrong route for the return path; test by pinging from the router with an explicit source address.

• ping 10.2.2.50 source 10.1.1.1 uses the address real traffic will carry, rather than the outgoing interface.
• If the sourced ping fails while a plain ping succeeds, the return path for that subnet is missing.
• Checking show ip route on the far router for the source subnet confirms it directly.

This asymmetry is the single most common routing fault, and it is easy to miss because every symptom appears on the outbound side.

It installs both routes and hashes each flow onto one of them, so all packets of a conversation take the same path.

• The hash typically covers source and destination addresses, and sometimes ports.
• Per-packet sharing is possible but reorders segments and triggers TCP fast retransmit.
• Only EIGRP supports unequal-cost sharing, using the variance command.

Because balancing is per flow, two paths do not double the speed of one transfer — the same limitation that applies to EtherChannel members.

Because it counts hops and ignores bandwidth, so a slow two-hop path beats a fast three-hop one.

• A 64 kbps backup link two hops away would be preferred over a 10 Gbps path three hops away.
• Its maximum of 15 hops also limits network size.
• OSPF derives cost from bandwidth and EIGRP combines bandwidth with delay, both of which reflect reality better.

RIP survives mainly in exams and in very small networks, where the topology is simple enough that hop count and best path happen to coincide.

A leftover static route, whose administrative distance of 1 beats anything a routing protocol offers.

• The routing table looks healthy, because the static route is valid.
• The protocol's own database shows the new path, which does not match the installed route.
• show ip route 10.2.2.50 names the source of the entry actually in use.

Comparing the routing table with the protocol database — show ip ospf database for example — is the reliable way to spot a route the protocol knows about but is not being allowed to install.

Because a packet's TTL reached zero at that router, so it was discarded; traceroute deliberately provokes this to map a path.

• Traceroute sends packets with TTL 1, then 2, then 3, collecting the address of each router that replies.
• The TTL exists to prevent packets circulating forever in a routing loop.
• The final destination replies differently — a port unreachable or an echo reply — which is how traceroute knows to stop.

Routers that are configured not to send ICMP appear as asterisks, which is why a traceroute with gaps in the middle is usually a filtering policy rather than packet loss.

Connected interfaces, static configuration, or a dynamic routing protocol. There is no fourth source.

• Connected routes appear automatically when an interface has an address and is up.
• Static routes are typed and persist regardless of what the network is doing.
• Dynamic routes are learned from neighbours and withdrawn when the topology changes.

Redistribution moves routes between protocols, but the route still enters the table through one of these three doors, with the administrative distance of whichever protocol installed it.

It is dropped, and the router sends an ICMP destination unreachable back to the source.

• If a default route exists, there is always a match, so this only happens where none is configured.
• The unreachable message is what makes a failure visible rather than a silent black hole.
• Routers rate-limit these messages, so a flood of unroutable traffic does not generate a flood of replies.

A null route — pointing a prefix at Null0 — uses the same mechanism deliberately, discarding traffic for a prefix without generating a reply if configured to stay quiet.

Because routing is stateless — each packet is looked up independently — so the work per packet is small enough to do in hardware.

• A route lookup is a longest-prefix match against a table that changes rarely.
• A firewall must track connection state, which means memory writes per flow and inspection above layer 4.
• This is why a router forwards at line rate and a firewall of the same price does not.

It is also why routers converge quickly after a change: there is no per-flow state to rebuild, only a table to update.