How Does Routing Work?

What Routing Does

Routing is the process of forwarding packets between different networks. When a device on 192.168.1.0/24 sends a packet to a device on 10.0.0.0/8, the packet must cross at least one router to get there. The router examines the destination IP address, consults its routing table, and forwards the packet out the appropriate interface toward the destination network.

Switches forward frames within a single network (same VLAN/subnet) using MAC addresses. Routers forward packets between different networks using IP addresses. This is the fundamental difference between Layer 2 (switching) and Layer 3 (routing).

Every packet that crosses a subnet boundary passes through a router. Your home router routes traffic between your local network (192.168.x.x) and the internet. Enterprise routers connect dozens or hundreds of internal subnets. Internet backbone routers route between autonomous systems across the globe.

The Routing Table

A routing table is a list of rules that tells the router where to send packets for each destination network. Each entry contains:

• Destination network - the network prefix and mask (e.g., 10.0.0.0/8)
• Next hop - the IP address of the next router toward the destination
• Interface - which physical or logical interface to use
• Metric - the "cost" of the route (used to choose between multiple routes to the same destination)
• Source - how the route was learned (directly connected, static, OSPF, BGP, etc.)

When a packet arrives, the router finds the most specific matching entry in the routing table (longest prefix match). A route to 10.1.0.0/16 is more specific than a route to 10.0.0.0/8, so a packet destined for 10.1.5.20 uses the /16 route. If no specific route exists, the router uses the default route (0.0.0.0/0).

Static Routing

Static routes are manually configured by an administrator. You tell the router: "to reach network 10.0.0.0/8, send packets to next hop 192.168.1.1 via interface eth0."

Static routing is simple, predictable, and requires no protocol overhead. It works well for small networks with stable topologies - a home network, a small office with one internet connection, or point-to-point links between two sites.

Static routing fails in larger networks because it does not adapt to changes. If a link goes down, the static route still points to it. The administrator must manually update the routing table. In a network with hundreds of routers and thousands of routes, manual management is not feasible.

Dynamic Routing Protocols

Dynamic routing protocols let routers discover routes automatically and adapt to network changes. Routers exchange information about which networks they can reach, and each router builds its own routing table from this shared knowledge.

RIP (Routing Information Protocol) - the simplest dynamic protocol. Routers share their entire routing table with neighbors every 30 seconds. Uses hop count as the metric (maximum 15 hops). Simple but slow to converge and limited in scale. Largely obsolete in modern networks.

OSPF (Open Shortest Path First) - a link-state protocol. Routers share information about their directly connected links, and each router independently calculates the shortest path to every destination. Faster convergence than RIP, supports larger networks, and uses cost (based on link bandwidth) as the metric. The most common interior routing protocol in enterprise networks.

BGP (Border Gateway Protocol) - the routing protocol that runs the internet. BGP routes between autonomous systems (organizations, ISPs, cloud providers). It uses path attributes (not just metrics) to make routing decisions, including AS path, local preference, and communities. BGP manages the full internet routing table of over 900,000 prefixes.

EIGRP (Enhanced Interior Gateway Routing Protocol) - a Cisco proprietary protocol that combines features of distance-vector and link-state protocols. Commonly found in Cisco-heavy enterprise networks.

graph LR
    subgraph "Network A (192.168.1.0/24)"
        PC["PC
192.168.1.50"]
    end
    PC -->|"Default route"| R1["Router 1"]
    R1 -->|"Route to 10.0.0.0/8"| R2["Router 2"]
    R2 -->|"Route to 10.1.0.0/16"| R3["Router 3"]
    subgraph "Network B (10.1.1.0/24)"
        SRV["Server
10.1.1.10"]
    end
    R3 --> SRV

Routing vs Switching

Property	Switching (Layer 2)	Routing (Layer 3)
Operates on	MAC addresses	IP addresses
Scope	Within a single LAN/VLAN	Between different networks
Decision basis	MAC address table	Routing table
Broadcast handling	Forwards broadcasts	Blocks broadcasts
Speed	Wire speed (hardware-based)	Slightly slower (header rewrite)
Example devices	Switches, bridges	Routers, Layer 3 switches

Layer 3 switches blur this boundary by performing routing at hardware speed. A modern campus network might use Layer 3 switches for inter-VLAN routing, achieving near-wire-speed routing performance without dedicated router hardware.

The Default Route

The default route (0.0.0.0/0) matches any destination that does not have a more specific route in the routing table. It is the "if nothing else matches, send it here" rule.

On your home network, every device has a default route pointing to the home router. The home router has a default route pointing to the ISP's router. The ISP's router has more specific routes for its customers and peers, plus a default route to its upstream providers. Eventually, the core internet routers have specific routes for everything and no default route - they are the "top of the pyramid."

Routing and Security

Routing determines the path packets take through a network, which has direct security implications. Route hijacking (advertising false routes via BGP) can redirect traffic through an attacker's network. Route leaks (accidentally announcing internal routes externally) can expose private networks. And the routing table itself reveals the network topology - which subnets exist, where they are, and how they are connected.

When the BLEShark Nano connects to a WiFi network, the DHCP response includes the default gateway's IP address, which is the first-hop router. This single piece of information anchors the network topology - it tells you where all traffic exits the local subnet and how the network connects to everything else.

Get the BLEShark Nano