IP Routing Explained
Lesson Contents
IP Routing Process
o H1
o R1
o R2
o H2
Conclusion
The actual forwarding of IP packets by routers is called IP routing. This has nothing to do
with the “learning” of network routes through static or dynamic routing protocols but has
everything to do with the steps that routers have to take when they forward an IP packet
from one interface to another.
In this lesson, I will walk you through an example and show you all steps that occur.
To do this, I will use the following topology:
Above we have two host computers and two routers. H1 is going to send an IP packet to
H2 which has to be routed by R1 and R2.
IP Routing Process
Let’s look at this step-by-step, device-by-device.
H1
Let’s start with H1. This host creates an IP packet with its own IP address ([Link]) as
the source and H2 ([Link]) as the destination. The first question that H1 will ask
itself is:
Is the destination local or remote?
It answers this question by looking at its own IP address, its subnet mask and the
destination IP address:
C:\Users\H1>ipconfig
Windows IP Configuration
Ethernet adapter Ethernet 1:
Connection-specific DNS Suffix . : [Link]
Link-local IPv6 Address . . . . . : fe80::88fd:962a:44d6:3a1f%4
IPv4 Address. . . . . . . . . . . : [Link]
Subnet Mask . . . . . . . . . . . : [Link]
Default Gateway . . . . . . . . . : [Link]
H1 is in network [Link]/24 so all IP addresses in the [Link] – 254 range are
local. Our destination ([Link]) is outside of the local subnet so that means we have
to use the default gateway.
H1 will now build an Ethernet frame, enters its own source MAC address and asks itself
the second question, do I know the destination MAC address of the default gateway?
It checks its ARP table to find the answer:
C:\Users\H1>arp -a
Interface: [Link] --- 0x4
Internet Address Physical Address Type
[Link] fa-16-3e-3f-fd-3c dynamic
[Link] ff-ff-ff-ff-ff-ff static
[Link] 01-00-5e-00-00-16 static
[Link] 01-00-5e-00-00-fb static
[Link] 01-00-5e-00-00-fc static
[Link] 01-00-5e-7f-ff-fa static
H1 has an ARP entry for [Link]. If not, it would have sent an ARP request. We now
have an Ethernet frame that carries an IP packet with the following addresses:
The frame will be on its way to R1.
R1
This Ethernet frame makes it to R1 which has more work to do than our host. The first
thing it does, is check if the FCS (Frame Check Sequence) of the Ethernet frame is correct
or not:
If the FCS is incorrect, the frame is dropped right away. There is no error recovery for
Ethernet, this is something that is done by protocols on upper layers, like TCP on the
transport layer.
If the FCS is correct, we will process the frame if:
The destination MAC address is the address of the interface of the router.
The destination MAC address is a broadcast address of the subnet that the router
interface is connected to.
The destination MAC address is a multicast address that the router listens to.
In this case, the destination MAC address matches the MAC address of R1’s
GigabitEthernet 0/1 interface so we will process it. We de-encapsulate (extract) the IP
packet out of the Ethernet frame which is then discarded:
The router will now look at the IP packet, and the first thing it does is check if the header
checksum is OK:
If the header checksum is not correct, the IP packet is dropped right away. There is also
no error recovery on the network layer, we rely on upper layers for this. If the header
checksum is correct, we continue by looking at the destination IP address:
R1 now checks its routing table to see if there is a match:
R1#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-
2
ia - IS-IS inter area, * - candidate default, U - per-user static
route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override, p - overrides from PfR
Gateway of last resort is not set
[Link]/24 is variably subnetted, 2 subnets, 2 masks
C [Link]/24 is directly connected, GigabitEthernet0/1
L [Link]/32 is directly connected, GigabitEthernet0/1
S [Link]/24 [1/0] via [Link]
[Link]/24 is variably subnetted, 2 subnets, 2 masks
C [Link]/24 is directly connected, GigabitEthernet0/2
L [Link]/32 is directly connected, GigabitEthernet0/2
Above you can see that R1 knows how to reach the [Link]/24 network, the next hop
IP address is [Link]. It will now do a second routing table lookup to see if it knows
how to reach [Link], we call this recursive routing. As you can see, there is an
entry for [Link]/24 with GigabitEthernet 0/2 as the interface to use.
By default, Cisco IOS routers build a routing table. It is possible to disable this and turn
your router into a regular host.
There is one thing left to do with the IP packet before we can forward it. Since we are
routing it, we have to decrease the TTL (Time to Live) field by one. R1 will do this and
since this changes the IP header, we have to calculate a new header checksum.
Once this is done, R1 checks its ARP table to see if there is an entry for [Link]:
R1#show ip arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet [Link] 58 fa16.3e87.9c2a ARPA
GigabitEthernet0/1
Internet [Link] - fa16.3e3f.fd3c ARPA
GigabitEthernet0/1
Internet [Link] - fa16.3e02.83a1 ARPA
GigabitEthernet0/2
Internet [Link] 95 fa16.3e01.0c98 ARPA
GigabitEthernet0/2
No problem there, we have an entry in the ARP table. If not, R1 will send an ARP request
to find the MAC address of [Link]. R1 builds a new Ethernet frame with its own
MAC address of the GigabitEthernet 0/2 interface and R2 as the destination. The IP packet
is then encapsulated in this new Ethernet frame.
And the frame will be on its way towards R2.
R2
This Ethernet frame makes it to R2. Like R1 it will first do this:
Check the FCS of the Ethernet frame.
De-encapsulates the IP packet, discard the frame.
Check the IP header checksum.
Check the destination IP address.
In the routing table, we find this:
R2#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-
2
ia - IS-IS inter area, * - candidate default, U - per-user static
route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override, p - overrides from PfR
Gateway of last resort is not set
S [Link]/24 [1/0] via [Link]
[Link]/24 is variably subnetted, 2 subnets, 2 masks
C [Link]/24 is directly connected, GigabitEthernet0/1
L [Link]/32 is directly connected, GigabitEthernet0/1
[Link]/24 is variably subnetted, 2 subnets, 2 masks
C [Link]/24 is directly connected, GigabitEthernet0/2
L [Link]/32 is directly connected, GigabitEthernet0/2
Network [Link]/24 is directly connected to R2 on its GigabitEthernet 0/1 interface.
R2 will now reduce the TTL of the IP packet from 254 to 253, recalculate the IP header
checksum and checks its ARP table to see if it knows how to reach [Link]:
R2#show ip arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet [Link] 121 fa16.3e4a.f598 ARPA
GigabitEthernet0/1
Internet [Link] - fa16.3e3c.7da4 ARPA
GigabitEthernet0/1
Internet [Link] 111 fa16.3e02.83a1 ARPA
GigabitEthernet0/2
Internet [Link] - fa16.3e01.0c98 ARPA
GigabitEthernet0/2
There is an ARP entry there. The new Ethernet frame is created, the IP packet
encapsulated and it has the following addresses:
The frame is then forwarded to H2.
H2
H2 receives the Ethernet frame and will:
Check the FCS
Find its own MAC address as the destination MAC address.
De-encapsulates the IP packet from the frame.
Finds its own IP address as the destination in the IP packet.