IP Routing Explained

The actual forwarding of IP packets by routers is called IP routing. This has nothing to do with the “learning” of network routes through static or dynamic routing protocols. but has everything to do with the steps that routers have to take when they forward an IP packet from one interface to another.

In this lesson, I will walk you through an example and show you all steps that occur.

To do this, I will use the following topology:

two hosts two routers ip mac addresses

Above we have two host computers and two routers. H1 is going to send an IP packet to H2 which has to be routed by R1 and R2.

IP Routing Process


Let’s look at this step-by-step, device-by-device.

H1

Let’s start with H1. This host creates an IP packet with its own IP address (192.168.1.1) as the source and H2 (192.168.2.2) as the destination. The first question that H1 will ask itself is:

  • Is the destination local or remote?

It answers this question by looking at its own IP address, its subnet mask and the destination IP address:

C:\Users\H1>ipconfig

Windows IP Configuration


Ethernet adapter Ethernet 1:

   Connection-specific DNS Suffix  . : nwl.local
   Link-local IPv6 Address . . . . . : fe80::88fd:962a:44d6:3a1f%4
   IPv4 Address. . . . . . . . . . . : 192.168.1.1
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.254

H1 is in network 192.168.1.0/24 so all IP addresses in the 192.168.1.1 – 254 range are local.  Our destination (192.168.2.2) is outside of the local subnet so that means we have to use the default gateway.

H1 will now build an Ethernet frame, enters its own source MAC address and asks itself the second question, do I know the destination MAC address of the default gateway?

It checks its ARP table to find the answer:

C:\Users\H1>arp -a

Interface: 192.168.1.1 --- 0x4
  Internet Address      Physical Address      Type
  192.168.1.254         fa-16-3e-3f-fd-3c     dynamic
  192.168.1.255         ff-ff-ff-ff-ff-ff     static
  224.0.0.22            01-00-5e-00-00-16     static
  224.0.0.251           01-00-5e-00-00-fb     static
  224.0.0.252           01-00-5e-00-00-fc     static
  239.255.255.250       01-00-5e-7f-ff-fa     static

H1 has an ARP entry for 192.168.1.254. If not, it would have sent an ARP request. We now have an Ethernet frame that carries an IP packet with the following addresses:

ethernet frame h1 r1

The frame will be on its way to R1.

R1

This Ethernet frame makes it to R1 which has more work to do than our host.  The first thing it does, is check if the FCS (Frame Check Sequence) of the Ethernet frame is correct or not:

ethernet frame fcs

If the FCS is incorrect, the frame is dropped right away. There is no error recovery for Ethernet, this is something that is done by protocols on upper layers, like TCP on the transport layer.

If the FCS is correct, we will process the frame if:

  • The destination MAC address is the address of the interface of the router.
  • The destination MAC address is a broadcast address of the subnet that the router interface is connected to.
  • The destination MAC address is a multicast address that the router listens to.

In this case, the destination MAC address matches the MAC address of R1’s GigabitEthernet 0/1 interface so we will process it. We de-encapsulate (extract) the IP packet out of the Ethernet frame which is then discarded:

extract ip packet from ethernet frame

The router will now look at the IP packet, and the first thing it does is check if the header checksum is OK:

ip header checksum field

If the header checksum is not correct, the IP packet is dropped right away. There is also no error recovery on the network layer, we rely on upper layers for this. If the header checksum is correct, we continue by looking at the destination IP address:

R1 now checks its routing table to see if there is a match:

R1#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/24 is directly connected, GigabitEthernet0/1
L        192.168.1.254/32 is directly connected, GigabitEthernet0/1
S     192.168.2.0/24 [1/0] via 192.168.12.2
      192.168.12.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.12.0/24 is directly connected, GigabitEthernet0/2
L        192.168.12.1/32 is directly connected, GigabitEthernet0/2

Above you can see that R1 knows how to reach the 192.168.2.0/24 network, the next hop IP address is 192.168.12.2. It will now do a second routing table lookup to see if it knows how to reach 192.168.12.2, we call this recursive routing. As you can see, there is an entry for 192.168.12.0/24 with GigabitEthernet 0/2 as the interface to use.

There is one thing left to do with the IP packet before we can forward it. Since we are routing it, we have to decrease the TTL (Time to Live) field by one. R1 will do this and since this changes the IP header, we have to calculate a new header checksum.

ip header decreased ttl

Once this is done, R1 checks its ARP table to see if there is an entry for 192.168.12.2:

R1#show ip arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  192.168.1.1            58   fa16.3e87.9c2a  ARPA   GigabitEthernet0/1
Internet  192.168.1.254           -   fa16.3e3f.fd3c  ARPA   GigabitEthernet0/1
Internet  192.168.12.1            -   fa16.3e02.83a1  ARPA   GigabitEthernet0/2
Internet  192.168.12.2           95   fa16.3e01.0c98  ARPA   GigabitEthernet0/2

No problem there, we have an entry in the ARP table. If not, R1 will send an ARP request to find the MAC address of 192.168.12.2. R1 builds a new Ethernet frame with its own MAC address of the GigabitEthernet 0/2 interface and R2 as the destination. The IP packet is then encapsulated in this new Ethernet frame.

ethernet frame r1 r2

And the frame will be on its way towards R2.

R2

This Ethernet frame makes it to R2. Like R1 it will first do this:

  • Check the FCS of the Ethernet frame.
  • De-encapsulates the IP packet, discard the frame.
  • Check the IP header checksum.
  • Check the destination IP address.

In the routing table, we find this:

R2#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

S     192.168.1.0/24 [1/0] via 192.168.12.1
      192.168.2.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.2.0/24 is directly connected, GigabitEthernet0/1
L        192.168.2.254/32 is directly connected, GigabitEthernet0/1
      192.168.12.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.12.0/24 is directly connected, GigabitEthernet0/2
L        192.168.12.2/32 is directly connected, GigabitEthernet0/2

Network 192.168.2.0/24 is directly connected to R2 on its GigabitEthernet 0/1 interface. R2 will now reduce the TTL of the IP packet from 254 to 253, recalculate the IP header checksum and checks its ARP table to see if it knows how to reach 192.168.2.2:

R2#show ip arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  192.168.2.2           121   fa16.3e4a.f598  ARPA   GigabitEthernet0/1
Internet  192.168.2.254           -   fa16.3e3c.7da4  ARPA   GigabitEthernet0/1
Internet  192.168.12.1          111   fa16.3e02.83a1  ARPA   GigabitEthernet0/2
Internet  192.168.12.2            -   fa16.3e01.0c98  ARPA   GigabitEthernet0/2

There is an ARP entry there. The new Ethernet frame is created, the IP packet encapsulated and it has the following addresses:

frame r2 h2

The frame is then forwarded to H2.

H2

H2 receives the Ethernet frame and will:

  • Check the FCS
  • Find its own MAC address as the destination MAC address.
  • De-encapsulates the IP packet from the frame.
  • Finds its own IP address as the destination in the IP packet.

H2 then looks for the protocol field to figure out what transport layer protocol we are dealing with, what happens next depends on the transport layer protocol that is used. That’s a story for another time.

Conclusion

You have now learned how an IP packet is forwarded from one router to another, also known as IP routing.

Let’s summarize this process.

The host has a simple decision to make:

  • Is the destination on the local subnet?
    • Check ARP table for destination IP address, if empty, send an ARP request.
  • Is the destination on a remote subnet?
    • Check ARP table for default gateway IP address, if empty, send an ARP request.

The router has to perform a number of tasks:

  • When it receives an Ethernet frame, check if the FCS (Frame Check Sequence) is correct. If not, drop the frame.
  • Check if the destination address of the frame is:
    • destined to our MAC address
    • destined to a broadcast address of the subnet our interface is in.
    • destined to a multicast address that we listen to.
  • De-encapsulate the IP packet from the frame, discard the Ethernet frame.
  • Look for a match in the routing table for the destination IP address, figure out what the outgoing interface and optionally, the next hop IP address is.
  • Decrease the TTL (Time to Live) field in the IP header, recalculate the header checksum.
  • Encapsulate the IP packet in a new Ethernet frame.
  • Check the ARP table for the destination IP address or next hop IP address.
  • Transmit the frame.

I hope this lesson has been useful to understand IP routing. Feel free to share this post!

Forum Replies

  1. Hi Rene,

    Great :slight_smile:

    What about the FCS when changed MAC on every L3 segment ? Its recalculate or not ? ? Header Checksum indicates value of IP header only , no upper layer (TCP/UDP Header+Data) where as FCS indicates total value including Ethernet Heaer + IP Header+ TCP/UDP Hearder+ Data , right ? Please correct me if i am wrong .Many Thanks

    br//
    zaman

  2. Hello Mohammad.

    You are correct, the FCS is calculated on every hop of the journey of a datagram. It is recalculated because the header of the frame in each hop changes. The header checksum of the IP header remains the same for the whole journey since the IP packet does not change.

    I hope this has been helpful!

    Laz

  3. Hi Laz,
    @lagapides
    But as Rene said, Header checksum will get recalculated at every hop since TTL gets decremented. Please correct me if I am wrong?

  4. Hi. Rene,
    Thx for your nice Tutorial.
    I have one question. Is Routing table execute sequentially (Top to bottom) & take action immediately like ACL do with his per ACE?? Appreciate your quick response in this regards .Thx

    br/
    zaman

  5. Hi Laz,
    Many Thanks for your reply as always :slight_smile: So , if you have 6+lac (BGP Prefix + Infrastructure prefix ) prefix in a routing table then Router will check with all 6+lac prefix from top to down and find out more specific entry and send the packet to exit interface , right ??

    I cant understand that you have wrote “Keep in mind that a routing table usually has the destinations in some sort of numerical order, so it does save time in finding the most accurate route”. could you please clear to me .Thx

    br//zaman

3 more replies! Ask a question or join the discussion by visiting our Community Forum