How Routing Works (In Depth)
Routing tables, hop-by-hop forwarding, and why the MAC changes but the IP does not
We know a packet leaves your network through the default gateway. But what happens after that, across the dozens of routers between you and a server on another continent? This chapter follows the packet hop by hop.
The key revelation: the destination IP stays the same the whole way, while the MAC address is rewritten at every single hop.
What routing actually is
Routing is the process of moving a packet across multiple networks toward its destination. No single router knows the whole path — each one just makes one decision: given this destination IP, what is the best next hop?
The routing table
Every router keeps a routing table: a list of destination networks (in CIDR) mapped to the next hop and outgoing interface. When a packet arrives, the router looks up the destination IP in this table to decide where to send it.
- Destination
- A network in CIDR form, e.g. 10.0.0.0/8.
- Next hop
- The IP of the next router to forward to (or "direct").
- Interface
- Which physical port to send out of.
Hop by hop (and TTL)
The packet is forwarded from router to router, each doing its own lookup. To prevent packets looping forever, the IP header carries a TTL (Time To Live) that each router decrements by one. If TTL reaches 0, the packet is dropped — a safety valve we will exploit in traceroute.
IP stays, MAC changes
This is the crucial insight. The destination IP is end-to-end — it identifies the final server and never changes along the way. But the frame’s MAC addresses are hop-to-hop: at each router the frame is unwrapped, and a new frame is built with the source MAC = this router and the destination MAC = the next router (found via ARP).
Remember: IP = the whole journey. MAC = only the current hop. This is exactly why you need both addresses.
Longest prefix match
A destination might match several routes in the table. The router always picks the most specific one — the longest prefix. So 10.1.2.3 matching both 10.0.0.0/8 and 10.1.0.0/16 goes via the /16, because /16 is more specific than /8.
Static vs dynamic routing
Routing tables can be filled in two ways. Static routes are configured by hand — fine for small setups. Dynamic routing lets routers exchange reachability information automatically using routing protocols like RIP, OSPF, and BGP (the protocol that glues the whole internet together).
The default route
What if nothing in the table matches? Routers use a default route, written 0.0.0.0/0 — the "when in doubt, send it here" entry, usually pointing at the ISP. Your own laptop has one too: its default route points at your default gateway.