Routing and IP addresses
How a packet finds its way across networks: the routing table, default route, static routes and NAT.
Lesson 1: Why networks need a map
A packet at the crossroads
In the previous course traffic stayed inside the company. Now the PC wants to send data to a remote network – somewhere across the internet, through several routers. The first stop is R1, and it stands at a crossroads: three paths lead out of it (to R2, to R3 and to the internet). How does R1 know which one to send the packet down? Trying them all is not an option.
Step by step
- The PC sends a packet with a destination IP somewhere far away. It reaches R1 – the first router on the path.
- R1 is a crossroads: three possible ways out. But the packet belongs on only one of them. Which?
- The router can’t guess blindly. It needs a map – a list of "to reach this network, go this way." That map is the routing table (next modules). Without it the packet goes nowhere.
The router as a junction
Each path out of the router leads to a different network – like signs at a junction: "left for 10.2.0.0/16", "right for 10.3.0.0/16", "straight on for everything else to the internet". The router looks at the packet’s destination IP, finds the matching sign and sends the packet that way (to the so-called next hop). Follow one packet.
Step by step
- Three signs: 10.2.0.0/16 via R2, 10.3.0.0/16 via R3, and 0.0.0.0/0 (everything else) to the internet.
- A packet arrives for 10.3.5.20. R1 asks: which network does this address belong to?
- 10.3.5.20 belongs to 10.3.0.0/16 → the sign points to R3. R1 sends the packet that way.
- The router does this for every packet: destination IP → matching network → next hop. Where it keeps those signs is the routing table – the next module.
The routing table
The router keeps those signs in a routing table. Each row says: destination network → next hop → out which interface. The last row 0.0.0.0/0 is the default route – "anything that doesn’t match elsewhere, send here" (usually to the internet). If a packet matches several rows, the most specific one wins (the longest mask) – this is longest-prefix match.
Step by step
- Three rows: two specific networks (via R2 and R3) and a default route 0.0.0.0/0 to the internet for everything else.
- A packet to 10.3.5.20 matches two rows: the specific 10.3.0.0/16 and the default 0.0.0.0/0. Now what?
- Longest-prefix match: the longest mask /16 wins (more specific than /0). The packet goes to R3. The default route is used only when nothing more specific matches.
- And a packet to, say, 200.1.1.9? It matches no specific network → the default route is used and it goes to the internet. That’s how a router serves the whole world with a few rows.
Lesson 2: The default route
You can’t know the whole world
A router knows its local networks – for those it has a row and knows the way. But the internet has nearly a million networks. A row for each of them? Impossible: huge memory, unmanageable upkeep, and new ones keep appearing. A router simply can’t know the whole world. It needs a clever shortcut.
Step by step
- R1 has rows for its local networks (10.0.0.0/8, 192.168.1.0/24). It knows them and the way to them.
- But what about the rest of the internet? Nearly a million networks. The router can’t have rows for them – memory and upkeep won’t bear it.
- The shortcut: one row "0.0.0.0/0 = send everything else to the provider". That’s the default route – next module.
The default route = the way out
The default route is the row 0.0.0.0/0: "anything that doesn’t match a specific network, send here". It usually leads to the provider (ISP) – out to the internet. It’s also called the gateway of last resort. Thanks to it a router serves the whole internet while knowing only its few networks + one default route.
Step by step
- R1 knows its local networks LAN A and LAN B – it has specific rows for them.
- A packet arrives for an unknown network (somewhere on the internet). No specific row matches. What now?
- The default route kicks in → the packet goes to the provider. R1 needn’t know where exactly that website is – just "send it upstream".
- And the ISP has its own default route even higher up. A chain of default routes carries the packet anywhere in the world – and almost nobody needs to know the whole internet. The chain only ends at the backbone routers, which do hold the full internet table (via the BGP protocol). Elegant.
The default gateway at home
You have the same principle at home on your PC. Your computer knows only its local network (say 192.168.1.0/24). Everything else – the whole internet – it sends to its default gateway, which is the router’s IP (e.g. 192.168.1.1). The PC doesn’t work out the way to that website; it just hands it to the router, which takes it from there. The default gateway is the default route seen from an end device.
Step by step
- Your PC knows only its local network (192.168.1.0/24). It doesn’t know the internet at all.
- You open a website in another network. The PC doesn’t know the way → it sends it to its default gateway = its router (192.168.1.1).
- The router does the same: by its default route it sends it to the provider and on into the internet. Everyone sends "the unknown one level up".
- So a default gateway on a host = a default route on a router – the same idea at every level. That’s why you set a "gateway" on a PC: it’s the door out.
Lesson 3: Static routes
When a static route
A router automatically knows only the networks it is directly connected to. Here R1 knows LAN A and the link to R2 – but it doesn’t know LAN B behind R2, nobody told it. When there are few networks, the simplest fix is to write the route by hand: "to reach 10.0.2.0/24, go via R2". This is a static route – a fixed row the admin enters.
Step by step
- R1 knows LAN A (directly) and the link to R2. But LAN B (10.0.2.0/24) behind R2 is not in its table.
- A PC in LAN A wants LAN B. The packet reaches R1 – which has no idea where next. Dropped (no route).
- The admin manually adds a static route: "to 10.0.2.0/24 go via R2". Now R1 knows the way.
- And the packet gets through: LAN A → R1 → R2 → LAN B. A static route is simple and reliable – when there are few networks.
What it looks like
What does such a static route actually look like? It has three key parts: the destination network (where you want to go), the mask (how big that network is) and the next hop (whom to hand the packet to next). E.g. "to network 10.0.2.0 with mask 255.255.255.0, go via neighbor 10.0.0.2 (R2)". Instead of a next hop you sometimes give an exit interface. Let’s light up the parts.
Step by step
- A static route = a command with three parts. Let’s go through them.
- Destination network – 10.0.2.0. "This route applies to packets heading into this network."
- Mask – 255.255.255.0 (/24). It says how big the destination network is (which addresses belong to it).
- Next hop – 10.0.0.2 (R2). Whom to hand the packet to next. (Sometimes an exit interface is given instead.)
Floating static (backup)
What if you want a backup? Two paths lead to LAN B: the primary via R2 and a backup via R3. You make two static routes to the same destination, but give the backup a worse "cost" (a higher administrative distance – detailed in the lesson The internet and who wins). The router then uses only the primary; the backup just "floats" in the background and kicks in only when the primary fails. This is a floating static route.
Step by step
- Two paths to LAN B: primary via R2, backup via R3. The backup has a worse cost, so for now it waits.
- Normally traffic flows the primary path via R2. The backup via R3 is unused – it just quietly "floats".
- The link to R2 fails. The primary route drops from the table. Without a backup, LAN B would now be unreachable.
- The floating static kicks in: traffic switches to the backup path via R3. Redundancy without a dynamic protocol – manual, but it works.
Where static falls short
Static routes are great while there are few networks. But imagine dozens of routers and hundreds of networks. You’d have to write every route by hand on every router – and rewrite it all on every change. And crucially: when a link fails, a static route doesn’t notice and happily sends packets into a dead end. That’s unmanageable. We need routers to tell each other the routes and react to outages – dynamic routing. Before we get there: in this lesson’s task you’ll write a static route yourself – router R1 has an empty table and you’ll fill in the missing route.
Step by step
- With two or three routers writing routes by hand is fine. A few lines and done.
- But like this? Every router must know a route to every network – that’s a lot of lines by hand, rewritten on every change. Unmanageable.
- And when a link fails, the static route still points at it – packets vanish into nothing. Nobody can fix that by hand in time.
- The fix: dynamic routing – routers share routes themselves and recompute after an outage. How they actually talk is the next lesson (and then OSPF).
Lesson 4: NAT and PAT
Why NAT
IPv4 addresses are scarce – the registries have practically handed out the free blocks (around 2019–2020) and new ones are allocated only rarely, otherwise expensively resold. So almost every home and company uses private addresses (10.x, 192.168.x) that must not be used on the internet (they’re not routable). So how do you get out? The edge router does NAT (Network Address Translation): on the way out it rewrites the private source address to its single public one. The whole network thus appears outside under one public IP.
Step by step
- The PC has a private IP 192.168.1.10. It’s valid only at home – invalid on the internet.
- The PC sends a packet out with source 192.168.1.10. A reply could never come back – that address "doesn’t exist" on the internet.
- The router does NAT: it rewrites the source to its public IP 203.0.113.5. Now it’s a valid address and the internet knows where to reply.
- The reply returns to 203.0.113.5, the router translates it back to 192.168.1.10 and delivers it. The whole LAN shares one public IP.
PAT: one IP for everyone
When the whole network has just one public IP, how does the router know who to return a reply to? It uses the port (the connection number, from the ISO/OSI and TCP/IP course). This enhanced NAT is called PAT (Port Address Translation, a.k.a. "NAT overload"). It assigns each outbound connection a unique source port and records in a NAT table: who (internal IP:port) = which public port. By the port it then sorts replies back. This is how one IP can hide hundreds of devices.
Step by step
- Two PCs, one public IP (203.0.113.5). When both go out, how does the router tell their replies apart?
- PC1 goes out. The router translates to the public IP with port 40001 and records it in the NAT table.
- PC2 goes out too – same public IP, but port 40002. They differ only by port.
- Replies come back to different ports. By the port in the NAT table the router knows whose they are and sorts them back. That’s PAT.
Port forwarding (DNAT)
NAT protects the inside: normally nobody outside can see in. But what if you want your own web or game server reachable from the internet? The server is inside with a private IP. The fix is port forwarding (a.k.a. DNAT): on the router you say "incoming to public IP:443, send to 192.168.1.20:443". The router then redirects that specific incoming connection to the internal server. (Exactly this you configure on the firewall in the simulator.)
Step by step
- The WEB server is inside with private IP 192.168.1.20. From the internet nobody can reach it – NAT hides it.
- The client tries public IP:443. But the router doesn’t know who inside it’s for → it drops it. Without a rule you can’t get in.
- You add a port-forward: "incoming to public IP:443 → 192.168.1.20:443". Now the router knows where inside to send it.
- The client connects: the router redirects (DNAT) the incoming :443 to the internal WEB. The server is reachable from the internet, the rest of the network stays hidden.
Hairpin NAT
One last trick. You have a web server inside that’s also reachable from outside (port forward) via a public IP / domain. What if a PC on the same network wants it, but via that public address (e.g. types the domain)? The traffic heads out toward the router (the gateway), the router sees that the public IP belongs to its own internal server and turns the traffic back inside. This "U-turn" is called hairpin NAT (NAT loopback).
Step by step
- The WEB server is inside and also has a public address (port forward). The PC is on the same network.
- The PC enters the server’s public IP (domain). As it’s not a local address, it sends it to the gateway = router.
- The router sees the public IP belongs to its own internal server and turns the traffic back to WEB. It never goes out to the internet.
- That’s hairpin NAT (NAT loopback). It isn’t always on by default – which is why "a home server via its domain doesn’t work from inside" until you enable it on the router.
Lesson 5: When a router isn’t enough
A company with many branches (WAN)
So far we’ve been in one building. A real company has a headquarters and branches – each its own network, joined over a WAN (leased lines, the internet, VPN). Traffic between branches must be routed: a user in branch A to a server at HQ, A to B… Static routes can do it – as long as there are two or three branches. But what about twenty?
Step by step
- HQ and two branches, each its own network, joined over the WAN. Three networks that must talk to each other.
- A user from branch A to a server at HQ → traffic routes over the WAN. With static routes it works for now.
- But with twenty branches each router needs routes to all the other networks. That’s a lot of lines by hand and it grows dizzyingly. Static can’t bear it.
A WAN link fails
And then the worst happens: a WAN link fails. With a static route that’s a problem – it still points at the dead link and traffic vanishes. The branch is cut off until someone manually switches to a backup path (e.g. via the other branch). For critical traffic that’s unacceptably slow. We’d want the switchover to happen by itself and instantly.
Step by step
- Normally traffic flows HQ ↔ branch A over the WAN link. All good.
- The WAN link to A fails. But the static route still points at it – traffic pours into nothing.
- Branch A is cut off. A backup path exists (A↔B↔HQ), but static won’t use it by itself – someone would have to bring it up by hand.
- We’d want traffic to reroute itself via B (A→B→HQ) within seconds. Static can’t do this – we need the routers to cooperate.
What we would want
Let’s write a wishlist. For a large network to work, we’d want routers to do three things on their own, without manual entry: learn where networks lead; pick the best path when there are several; and recompute after a failure. This is exactly what dynamic routing does – routers talk to each other and keep the network map themselves. How they do it is the next lesson.
Step by step
- Learn networks themselves. No more "I don’t know" – let the router find out where each network leads, without my hand-entry.
- Pick the best path. When several paths exist, let the router choose the best (fastest / shortest), not a random one.
- Recompute after a failure. When something breaks, let the network reroute itself quickly – no night calls for the admin.
- A dynamic routing protocol grants these three wishes. Routers talk, share a map and compute paths. How exactly they talk is the very next lesson.
Lesson 6: How routers share maps
Routers talk to each other
The heart of dynamic routing is surprisingly simple: routers talk to each other. Each tells its neighbors what networks it knows ("I can reach network A"), and what it learns it passes on. The information thus spreads across the whole network and soon every router knows a path to every network – without a single hand-written line. Watch the message spread.
Step by step
- At the start each router knows only its directly connected network: R1 net A, R2 net B, R3 net C. It doesn’t know the others.
- R1 tells its neighbor R2: "I can reach net A". R2 notes it down: net A is via R1.
- R2 passes it on to R3 – and adds its own net B. The information spreads across the network, further and further.
- Soon everyone knows a path to every network – automatically, no hand-entry. And when something changes, a new message goes out. That’s dynamic routing.
Distance-vector vs link-state
How exactly do routers tell each other the routes? There are two approaches. Distance-vector (e.g. RIP): "I tell neighbors how far (how many hops) I am from each network" – the neighbor trusts it and computes second-hand. Simple, but slower (it re-advertises whole tables, not just the changes) and "short-sighted". Link-state (e.g. OSPF): "everyone publishes their links, all build a complete map of the network and compute the best path themselves". Smarter and faster – and that’s what we’re heading for.
Step by step
- Two ways routers share routes. Let’s take both.
- Distance-vector: a router tells its neighbor only the distance ("2 hops"), not the whole map. The neighbor trusts it. Simple, but after a failure it spreads slowly and can get confused.
- Link-state: each publishes its links to everyone. From that each builds a complete map itself and computes the best path. More work, but accurate and fast.
- Modern enterprise networks run link-state – specifically OSPF. It has the full map, so it reacts fast and smart. How OSPF works inside is the next lesson (and we’ll build it).
Hello and adjacency
Before routers exchange routes, they must find each other and agree. So they send small Hello packets ("hi, I’m here"). When two neighbors exchange Hellos, they recognize each other and become neighbors (form an adjacency). Hellos then keep going like a heartbeat – "alive, the link works". And when Hellos stop, the other side detects the failure within tens of seconds (the default dead interval; with timer tuning or BFD even sub-second) and triggers a route recompute.
Step by step
- R1 and R2 send each other Hello packets – "hi, I’m here, I speak OSPF".
- They exchange and recognize each other → they become neighbors. Now they can start exchanging route information.
- Hellos keep going round and round like a heartbeat: "alive, the link works". This maintains the adjacency.
- When Hellos stop, R1 detects within tens of seconds that R2 (or the link) is down and triggers a route recompute. This is how the network reacts fast to failures.
Metric: the best path
When there are several paths to a destination, how do you pick the best? That criterion is the metric. RIP counts hops (hop count) – it picks the path through the fewest routers, even if it runs over a slow link. OSPF uses cost based on link speed – it prefers several fast hops over one slow one. That’s why OSPF chooses smarter. Watch the difference.
Step by step
- From A to B there are two paths: the upper 1 hop but a slow link; the lower 2 hops over fast links. Which is better?
- RIP (hop count) counts hops → it picks the upper path (1 hop). But that runs over a slow link – actually worse.
- OSPF (cost) goes by speed → it picks the lower path: more hops, but over fast links = lower cost. Genuinely better.
- That’s why a speed-based metric (OSPF) is smarter than just counting hops. How OSPF computes that cost and finds the best path is the next lesson – and we’ll build it into the simulator.
Lesson 7: Inside OSPF
Same map, own computation
OSPF is a link-state protocol and its principle is surprisingly simple: each router tells the others what links it has (who its neighbor is, how fast the link). Once routers exchange this, everyone holds the same complete map of the whole network – called the LSDB. And from that map each router computes the cheapest path to every network by itself (the Dijkstra algorithm; a path’s cost = the sum of link costs). The same map everywhere → the paths fit together without loops.
Step by step
- At the start each router knows only its own links (who it’s directly attached to). It can’t see the whole network.
- Each tells the others what it sees – the link information spreads across the whole network neighbor to neighbor.
- The result: every router holds an identical map of the whole network – the LSDB. No one has an edge or a blind spot.
- From the map each computes the cheapest path to every network by itself (Dijkstra; path cost = sum of link costs) and fills its routing table. That’s OSPF in a nutshell.
Cost: how it’s computed
Where does OSPF get a link’s cost? From its speed: a faster link = a lower cost (roughly cost ≈ reference speed ÷ link speed). A slow 100Mb/s link has a high cost, a fast 1Gb/s a low one. The path cost = the sum of link costs along it. OSPF then picks the path with the lowest total – happily more hops over fast links. And this is exactly what this simulator can now do: set a link’s cost and traffic takes the cheapest path.
Step by step
- From A to B: the upper path = 1 hop over 100Mb/s (cost 100). The lower = 2 hops over 1Gb/s (cost 10 + 10 = 20).
- If OSPF counted hops like RIP, it would pick the upper path (1 hop). But its cost 100 is high – over a slow link. A bad choice.
- OSPF adds up the costs: the lower path 20 < 100 → it picks that, even with more hops. Lower cost = better path.
- In the simulator: this logic is now built into the engine – once you set a link’s cost, routers seek the cheapest path (Dijkstra), not the shortest. The link speed now sets the cost by itself (faster = cheaper), and a right-click on the link lets you override it manually. Try it in the task.
What’s under the hood → Course 7
That’s the principle of OSPF – and for practical network work it’s all you need for now. There’s of course more under the hood: exactly how routers find each other and form adjacencies (Hello, DR/BDR), how the map is spread and maintained (LSAs, flooding), how Dijkstra builds the path tree step by step – and how a large network is split into areas so it scales. All of that is covered in depth in the OSPF in depth course. Now let’s see how fast a network recovers from a change – convergence.
Lesson 8: Convergence
What convergence is
A network is converged when all routers agree on the current map and paths – traffic flows where it should. But the moment something changes (a link fails, a network appears), there’s a brief window where someone doesn’t know yet and the paths disagree. Routers flood an update, recompute Dijkstra and re-align. That settling is called convergence, and the time to it the convergence time. Watch it happen.
Step by step
- The network is converged: traffic from R1 to R4 goes via R2. Everyone agrees, all works.
- The R2–R4 link fails. Suddenly the path everyone computed is gone. The network is briefly out of sync.
- A new LSA is flooded ("R2–R4 is gone"). Each router recomputes the cheapest paths from the current map.
- Done: traffic now goes R2 → R3 → R4. The network is converged again. This all happens in seconds and automatically.
How fast
How fast does the network settle? With OSPF, on the order of seconds: the longest part is noticing a neighbor has failed; spreading the news and recomputing paths take fractions of a second. Fast convergence is one of OSPF’s main strengths – older protocols like RIP can take minutes to recover after a change (why, you’ll see in the next lesson when we compare protocols). And how failure detection can be tuned – Hello/dead intervals and BFD – is covered in the OSPF in depth course.
Lesson 9: Protocols in the company network
How a router learns routes
Back to what you already know: static routes don’t scale (the static routes lesson), and routers can exchange maps on their own — you saw how (hello, adjacency, metric) and how fast (convergence). Now we widen the question to WHAT makes the individual protocols differ. In practice you’ll meet five: RIP, OSPF, EIGRP, IS-IS and BGP. They don’t differ in the "exchange routes" principle, but in the metric, convergence speed and above all where they’re deployed — LAN, ISP backbone, or the internet edge. And since several can run on one router at once, in the course’s final lesson we tackle a new question: which one wins?
Step by step
- R1 only knows its directly connected networks (e.g. the PC side). It has no route to the remote SRV yet.
- R1 learns the route to SRV statically or dynamically – you know that. The new question: which protocol? The choice decides which path wins.
- On the same network each protocol picks a different path, because it measures with a different metric. We’ll go from the simplest: RIP – next.
RIP — counting hops
You already know distance-vector: a router trusts a neighbor’s "it’s this far" and never sees the whole map. RIP is its oldest and purest embodiment – and here are the concrete numbers you didn’t have yet: metric = hop count, capped at 15 (16 = "unreachable"), the whole table re-advertised every 30 seconds plus long hold-down timers after a failure (hence the slow convergence you saw last time), trustworthiness AD 120 – the worst of the common protocols. And the practical weakness: fewest hops ≠ fastest path. Today it’s obsolete – you’ll only meet it in an old network or a lab.
Step by step
- Two paths PC→SRV: a direct one with 1 hop between (R1→R4, but slow), and a fast chain via R2+R3 (more hops, fast links).
- RIP counts only hops: the direct path = fewer routers, so it wins – even over the slow link. RIP doesn’t care about speed.
- Traffic flows the slow direct path. That’s RIP’s weakness: fewest hops ≠ best path. Hence OSPF came – next.
OSPF — the cheapest path
You already know the principle of OSPF – a shared map (LSDB) and the cheapest path by cost (Dijkstra). Here we place it in the family and add what you didn’t have yet: it’s an open standard (an RFC – runs on every vendor’s boxes, no vendor lock-in), it has AD 110, and it’s today’s default choice in enterprise networks. Above all, we’ll pit it against RIP on the same topology: where RIP blindly picked the slow "short" path, OSPF – with cost based on speed – picks the longer but faster one.
Step by step
- Same network, but OSPF looks at cost: the direct slow link = 100, the fast chain via R2+R3 = 10+10+10 = 30.
- Dijkstra picks the cheapest path: the chain (30) < the direct one (100). More hops, but faster – exactly the opposite of RIP.
- Traffic flows the fast chain. That’s OSPF’s strength: it decides by real speed, not the number of routers.
EIGRP — a composite metric
EIGRP is Cisco’s: the metric is composite – mainly bandwidth and delay, not just hops or a single cost. It keeps a pre-computed backup route (feasible successor), so on a failure it switches almost instantly (fast convergence). Once proprietary; Cisco later published it (partially open). In the simulator it picks the "best path" much like OSPF – the real difference is the metric type and its lower administrative distance (90), so running next to OSPF, EIGRP wins.
Step by step
- EIGRP, like OSPF, picks the fast path (composite metric). On top of that it keeps a backup route pre-computed.
- The fast link fails. Thanks to the feasible successor, EIGRP already has the backup computed – it doesn’t wait to recompute the whole map.
- The switch is almost instant onto the backup (direct) path. And since EIGRP has AD 90, next to OSPF (110) it would win.
Lesson 10: The internet and who wins
IS-IS and BGP — backbones and the internet
IS-IS is link-state like OSPF (also Dijkstra, also cost) but runs directly on L2 and is popular on ISP backbones – it scales very well. Think of it as "the providers’ OSPF". BGP is a different league – between autonomous systems (AS), it’s the internet’s protocol. It doesn’t pick by speed but by policy (AS-path length = how many carriers the path crosses, preferences, business relationships between carriers). Slow but stable; it holds the whole global routing table. In the simulator you won’t see it as a choice on a LAN router – it belongs at the internet edge (a border router "speaks BGP to the ISP").
Step by step
- Inside the company the routing runs, say, OSPF (R-LAN). But how does a packet reach the internet?
- At the edge, R-EDGE talks to the provider via BGP – the protocol between carriers. It picks by policy, not speed.
- Traffic to unknown targets goes out the default route – in the path test you’ll see "via BGP (AD 20)". The ISP backbone often runs IS-IS.
Which one wins? Administrative distance
What if a router has a route to the same network from several sources? Administrative distance decides – the lower, the more trusted. Order: connected 0 · static 1 · eBGP 20 · EIGRP 90 · OSPF 110 · IS-IS 115 · RIP 120. So if a router runs both OSPF and RIP, OSPF wins (110 < 120). AD is a local router decision, not a protocol metric.
Step by step
- Every route source has its AD. A connected network (0) and a static route (1) always beat dynamic routing.
- Both OSPF (110) and RIP (120) run and both know a route to the same network. Who wins?
- OSPF – it has the lower AD (110 < 120), so it’s more trusted. The RIP route doesn’t even make it into the table. And that wraps up the routing course: the network can find a path anywhere. But for now anyone can use that path – guarding and filtering that traffic is the network security course.