Every time you open a website, send an email, or stream a video, your data travels across many networks before it reaches its destination. Somewhere along that journey, a router has to decide: “Where do I send this packet next?” This decision, called a forwarding decision, is one of the most fundamental jobs of a router.
This article explains, from first principles, exactly how a router makes this decision by default — without any fancy policies, without route maps, and without special traffic engineering. Just the plain, standard behavior every router uses unless configured otherwise.
By the end of this article, you will understand:
- What a router actually is and why it exists
- The step-by-step logic a router follows for every single packet
- How the routing table, ARP, and interfaces work together
- Real Cisco and Linux examples
- Common troubleshooting scenarios
- Best practices for predictable forwarding behavior
What Is a Router, Really?
At its core, a router is a device with multiple network interfaces, each connected to a different network (or subnet). Its job is to move packets from one network to another based on the destination IP address in the packet header.
Think of a router like a postal sorting office. Letters (packets) arrive with an address written on them (the destination IP). The sorting office doesn’t care what’s inside the envelope — it only cares about the address, and it uses that address to decide which truck (interface) the letter should go on next.
A switch, by contrast, mostly operates within a single network (Layer 2), using MAC addresses. A router works between networks (Layer 3), using IP addresses. This distinction is the foundation of everything that follows.
The Core Principle: Destination-Based Forwarding
By default, a router makes forwarding decisions using destination-based routing. This means:
The router looks ONLY at the destination IP address of the incoming packet, and decides where to send it based on that address alone.
It does not, by default, look at:
- The source IP address (for forwarding purposes)
- The application or port number
- The user identity
- The time of day
All of those things can be considered if you configure policy-based routing (PBR), but that is not default behavior. Default behavior is simple and predictable: destination IP in, best matching route out.
Step-by-Step: The Router’s Decision Process
Let’s walk through exactly what happens inside a router when a packet arrives.
Step 1: The Packet Arrives on an Interface
A frame arrives on a physical or virtual interface (e.g., GigabitEthernet0/0). The router first checks the Layer 2 frame to confirm it’s addressed to the router’s own MAC address (or a multicast/broadcast address it should process). If so, it strips the Layer 2 header and looks at the Layer 3 (IP) header inside.
Step 2: The Router Extracts the Destination IP Address
The router reads the destination IP address field from the IP header. This is the single most important piece of information used in the default forwarding decision.
Step 3: The Router Performs a Routing Table Lookup
The router searches its routing table (also called the Routing Information Base, or RIB) for an entry that matches the destination IP address.
This is where the concept of longest prefix match comes in — arguably the single most important rule in all of routing.
Longest Prefix Match Rule: When multiple routes in the table could match a destination address, the router always chooses the route with the most specific (longest) prefix length.
For example, imagine the routing table contains:
0.0.0.0/0 via 203.0.113.1 (default route)
10.0.0.0/8 via 192.168.1.2
10.1.1.0/24 via 192.168.1.3If a packet’s destination is 10.1.1.50, all three routes technically “match” in a loose sense, but only 10.1.1.0/24 is the longest match (most specific), so the router picks that one. The /24 beats the /8, and the /8 beats the /0 default route.
Step 4: The Router Determines the Next Hop and Exit Interface
Once the best matching route is found, the routing table entry tells the router two critical things:
- The exit interface (which physical or logical port to send the packet out of)
- The next-hop IP address (the IP of the next router, if applicable)
If the destination network is directly connected to the router, there is no next hop — the router will look up the destination host directly.
Step 5: Layer 2 Rewrite (ARP or Neighbor Discovery)
Before actually sending the packet, the router needs the MAC address of the next hop (or the destination host if directly connected). It checks its ARP cache (for IPv4) or neighbor cache (for IPv6). If it doesn’t have the mapping, it sends an ARP Request (or Neighbor Solicitation) to discover it.
Step 6: The Router Rewrites Headers and Forwards
The router:
- Decrements the IP TTL (Time to Live) by 1
- Recalculates the IP header checksum
- Builds a new Layer 2 frame header with the correct destination MAC address
- Sends the frame out the determined exit interface
Step 7: If No Route Matches
If the router finds no matching route (and no default route exists), it drops the packet and — for IPv4 — typically sends back an ICMP Destination Unreachable message to the source.
Visualizing the Process
flowchart TD
A[Packet arrives on interface] --> B[Extract destination IP address]
B --> C[Search routing table for matches]
C --> D{Route found?}
D -- No --> E[Drop packet, send ICMP Unreachable]
D -- Yes --> F[Select route with longest prefix match]
F --> G[Determine next hop and exit interface]
G --> H[Resolve next-hop MAC via ARP/ND]
H --> I[Decrement TTL, rewrite headers]
I --> J[Forward frame out exit interface]Why “Default” Matters
The word “default” in this topic title is important. By default:
- Routers do not inspect payload content
- Routers do not consider the source address when choosing a path
- Routers do not load-balance unless multiple equal-cost paths exist and equal-cost multi-path (ECMP) is supported and enabled
- Routers always use longest prefix match, never “first match” or “most recently learned route” unless a tie needs breaking
This predictability is intentional. It means two different routers from two different vendors, given the same routing table, will make the exact same forwarding decision for a given packet. This consistency is what makes the global Internet function.
A Real-World Example
Imagine a small company network:
- LAN A:
192.168.10.0/24— connected to Router R1’s Gi0/0 - LAN B:
192.168.20.0/24— connected to Router R1’s Gi0/1 - The Internet — reachable via Router R1’s Gi0/2, next hop
203.0.113.1(ISP router)
Router R1’s routing table looks like this:
C 192.168.10.0/24 is directly connected, GigabitEthernet0/0
C 192.168.20.0/24 is directly connected, GigabitEthernet0/1
S* 0.0.0.0/0 [1/0] via 203.0.113.1, GigabitEthernet0/2If a PC on LAN A (192.168.10.5) sends a packet to a server on LAN B (192.168.20.10), the router:
- Sees destination
192.168.20.10 - Finds
192.168.20.0/24as the longest match (directly connected) - Forwards out Gi0/1 after resolving the ARP for
192.168.20.10
If the same PC sends a packet to 8.8.8.8 (Google DNS):
- No specific match exists for
8.8.8.8 - The only matching route is the default
0.0.0.0/0 - The router sends it out Gi0/2 to
203.0.113.1
Cisco IOS Example: Viewing the Forwarding Decision Process
You can watch these decisions happen in real time using Cisco IOS debug commands (only in a lab — never on a production router, as debug is CPU-intensive):
Router# debug ip packet
Router# show ip route 192.168.20.10
Routing entry for 192.168.20.0/24
Known via "connected", distance 0, metric 0
Routing Descriptor Blocks:
* directly connected, via GigabitEthernet0/1
Route metric is 0, traffic share count is 1The show ip route command is extremely useful — it tells you exactly which route the router would use for a specific destination, without needing to send actual traffic.
You can also verify the full table:
Router# show ip route
Codes: L - local, C - connected, S - static, R - RIP, O - OSPF, ...
Gateway of last resort is 203.0.113.1 to network 0.0.0.0
S* 0.0.0.0/0 [1/0] via 203.0.113.1
192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.10.0/24 is directly connected, GigabitEthernet0/0
L 192.168.10.1/32 is directly connected, GigabitEthernet0/0Linux Example: Forwarding Decisions on a Linux Router
Linux machines can also act as routers when IP forwarding is enabled. This is common in cloud environments, containers, and home labs.
Enable forwarding:
sudo sysctl -w net.ipv4.ip_forward=1View the routing table:
ip route showExample output:
default via 203.0.113.1 dev eth0
192.168.10.0/24 dev eth1 proto kernel scope link src 192.168.10.1
192.168.20.0/24 dev eth2 proto kernel scope link src 192.168.20.1You can ask the Linux kernel exactly which route it would use for a specific destination — this mirrors the router’s internal decision process precisely:
ip route get 192.168.20.10Output:
192.168.20.10 dev eth2 src 192.168.20.1
cacheThis confirms Linux performs the exact same longest-prefix-match logic as a Cisco router.
Python Example: Simulating Longest Prefix Match
Understanding the algorithm is easier when you can see it in code. Here’s a simplified Python simulation of longest prefix match logic using the ipaddress module:
import ipaddress
routing_table = [
("0.0.0.0/0", "203.0.113.1"),
("192.168.10.0/24", "connected"),
("192.168.20.0/24", "connected"),
]
def find_best_route(destination_ip, table):
dest = ipaddress.ip_address(destination_ip)
best_match = None
best_prefix_len = -1
for network_str, next_hop in table:
network = ipaddress.ip_network(network_str)
if dest in network:
if network.prefixlen > best_prefix_len:
best_prefix_len = network.prefixlen
best_match = (network_str, next_hop)
return best_match
print(find_best_route("192.168.20.10", routing_table))
# Output: ('192.168.20.0/24', 'connected')
print(find_best_route("8.8.8.8", routing_table))
# Output: ('0.0.0.0/0', '203.0.113.1')This tiny script captures the essence of what every router on Earth does billions of times per second: compare the destination against all known networks and pick the most specific match.
Common Misconceptions
| Misconception | Reality |
|---|---|
| “Routers pick the route with the lowest metric first, always.” | Longest prefix match ALWAYS wins first. Metric only decides between routes of the same prefix length from different sources. |
| “Routers look at the source address to decide the path.” | Not by default. Only Policy-Based Routing (PBR) does this. |
| “The default route is used whenever it’s present, even if a better route exists.” | No — the default route (0.0.0.0/0) is the last resort, used only when no more specific route matches. |
| “A switch and a router make forwarding decisions the same way.” | No — switches use MAC address tables and Layer 2 logic; routers use IP routing tables and Layer 3 logic. |
Best Practices
- Keep routing tables clean. Summarize routes where possible to reduce lookup complexity and table size.
- Always configure a default route or full routing for any router that needs Internet or upstream access — otherwise, packets to unknown destinations will be silently dropped.
- Use
show ip route(Cisco) orip route get(Linux) during design and troubleshooting to predict router behavior before deploying changes. - Avoid overlapping subnets in your addressing plan — they complicate longest-prefix-match behavior and can cause unexpected forwarding paths.
- Document your default gateway and route redistribution points so forwarding behavior is predictable across your organization.
Troubleshooting Forwarding Decisions
When traffic doesn’t reach its destination, always start by asking: “What would the router’s forwarding decision actually be here?”
Troubleshooting Checklist
- Check the routing table — is there a route to the destination at all?
show ip route - Check for a missing default route — many “can’t reach the Internet” issues are simply a missing
0.0.0.0/0entry. - Verify ARP resolution — even a correct route is useless if the router can’t resolve the next-hop MAC address.
show ip arp - Check for asymmetric routing — packets going out one path and replies coming back another can break stateful firewalls and NAT.
- Verify interface status — a route pointing to a down interface will not be installed in the active forwarding table (it may still appear in the configuration, but not in
show ip route). - Use traceroute/tracert to see the actual hop-by-hop path packets are taking, and compare it to what the routing table predicts.
# Linux/macOS
traceroute 8.8.8.8
# Windows
tracert 8.8.8.8Summary
A router’s default forwarding decision boils down to one elegant, consistent process:
- Look at the destination IP address.
- Find the routing table entry with the longest matching prefix.
- Forward the packet toward the associated next hop and exit interface.
- If nothing matches, drop the packet.
There is no magic, no deep packet inspection, and no consideration of the source by default. This simplicity is exactly why the Internet — a network of networks built by thousands of independent organizations — can function as one coherent whole. Every router, regardless of manufacturer, follows this same fundamental logic.
