Lesson 1 — Routing Fundamentals and the Forwarding Decision

Week 4Lesson 1Required34 min estimated0% progress

Routing Fundamentals and the Forwarding Decision

Trace how a router turns a packet's destination IP into a single forwarding action, and prove that decision by reading the matched line in show ip route.

What you'll learn (4 objectives)~34 min: video → lesson → check → apply → lab prep

Learning objectives

Explain the router's per-packet job as a repeated destination-lookup-and-forward loop that rewrites Layer 2 while preserving Layer 3
Describe the three route sources — connected, static, dynamic — that populate the routing table
Walk a destination IP through a show ip route excerpt and name the winning line, its next hop, and its exit interface
Distinguish a control-plane routing decision from the data-plane act of forwarding, and predict the result when no route matches

Terms you will see

Routing table (RIB)Control planeData planeNext hopExit interfaceRecursive lookupConnected routeStatic routeDynamic routeGateway of last resort

Time breakdown

Read the notes16 min
Routing Table Trainer12 min
Forwarding-trace practice6 min

Opens on YouTube

Optional video

Routing Fundamentals (Day 11 part 1)

By Jeremy's IT Lab · Opens externally on YouTube

Assigned watch: ~8 min

Watch on YouTube

The link opens in a new browser tab. Return here when you finish watching.

Watch for these concepts

A destination IP matched to exactly one routing-table entry, then forwarded
The Layer 2 header being rebuilt at each router while the Layer 3 destination stays fixed

Go beyond the video

The assigned video introduces the idea. CCNA Practice Labs completes the learning path: clarify core concepts, explore how each device behaves, visualize the communication path, check your understanding, and prepare for hands-on lab work.

Watch the concept → understand it → visualize it → practice it → apply it.

One job per packet

A router has exactly one job per packet: decide where to send it next, then send it. Everything else — protocols, timers, metrics — exists only to fill in the table the router consults for that decision. Stripped down, the loop is four steps.

A frame arrives; the router de-encapsulates it and reads the destination IP address in the packet header.
It searches its routing table for the entry that best matches that destination.
If it finds a match, it forwards the packet out the interface that entry names, toward the next hop that entry names.
If it finds no match and has no default route, it drops the packet and sends an ICMP destination-unreachable message back to the source.

A missing route is a hard stop, not a best effort

Routers do not flood, do not broadcast, and do not guess a nearby subnet. This is the point learners most often get wrong, usually by carrying switch intuition over from Week 3. A switch floods when it does not know; a router drops. The absence of a route is an explicit failure, reported back to the sender.

Notice what the router does not look at: the source address. Forwarding is destination-driven. The source only matters for the return trip, which is a completely separate decision made by the routers on the way back — a fact that becomes very concrete in Lesson 3.

Layer 3 is preserved, Layer 2 is disposable

Week 1 stated this rule from the packet's point of view. Here it is from the router's. As a packet crosses a router, the destination IP written by the original host does not change — 10.1.4.7 stays 10.1.4.7 from the first hop to the last. What changes at every router is the frame: the router strips the incoming Ethernet header, looks up the destination, and builds a new frame with its own interface MAC as the source and the next hop's MAC as the destination.

The next-hop IP is not a field in the packet

This surprises people. When a route says via 10.1.2.2, that address is never written into the packet. It exists only so the router knows whose MAC address to ARP for when building the new frame. The packet keeps one fixed Layer 3 destination while wearing a series of temporary Layer 2 envelopes, one per link — which is exactly what lets a single packet cross networks built on different media without the original host knowing anything about the path.

Routing is a decision; forwarding is the action

CCNA separates these deliberately. The control plane builds and maintains the routing table — learning routes, running protocols, picking winners. The data plane is the fast per-packet act of matching a destination and pushing the frame out an interface.

When you configure a static route or run OSPF, you are shaping the control plane. When a packet actually moves, that is the data plane using what the control plane already decided. show ip route is your window into the control plane's finished product: the set of decisions the router is prepared to make, before any packet arrives to test them.

Three sources feed the table

Where routes come from

Source	Code	How it gets there	Covered in
Connected	C and L	Created automatically for every up/up interface that has an IP address	Lesson 2, this week
Static	S	Configured by hand with the ip route command	Lessons 3 and 4, this week
Dynamic	O, D, R …	Learned from a routing protocol such as OSPF, which discovers neighbours and advertises reachability	Week 5

Each entry records four things you must be able to read: how it was learned (the code letter), the destination prefix and length, the administrative distance and metric in brackets, and the forwarding instruction — a next-hop IP, an exit interface, or both. This lesson focuses on the last of those. The bracketed values decide which route is installed when several compete, and that is Lesson 5.

Reading a forwarding decision out of the table

show ip route on a small router

R1# show ip route
Codes: C - connected, L - local, S - static, O - OSPF
       * - candidate default

      10.0.0.0/8 is variably subnetted, 5 subnets, 3 masks
C        10.1.1.0/24 is directly connected, GigabitEthernet0/0
L        10.1.1.1/32 is directly connected, GigabitEthernet0/0
C        10.1.2.0/30 is directly connected, GigabitEthernet0/1
L        10.1.2.1/32 is directly connected, GigabitEthernet0/1
S        10.1.4.0/24 [1/0] via 10.1.2.2
S*    0.0.0.0/0 [1/0] via 203.0.113.1

Each line as a forwarding rule

Entry	What it means
C 10.1.1.0/24 … Gi0/0	A connected route. Anything for this subnet is on the LAN off Gi0/0, so the router ARPs directly for the host. No next-hop router involved.
L 10.1.1.1/32 … Gi0/0	The local route — the router's own address as a host route. It exists so the router recognises traffic addressed to itself. You read it; you never configure it.
S 10.1.4.0/24 [1/0] via 10.1.2.2	A static route. [1/0] is administrative distance 1, metric 0. To reach the prefix, hand the packet to 10.1.2.2 — which the router must itself look up, a second search called recursive lookup.
S* 0.0.0.0/0 [1/0] via 203.0.113.1	The default route, the gateway of last resort. The asterisk marks it a candidate default. It matches any destination but only wins when nothing more specific does.

Ask the router directly which entry wins

R1# show ip route 10.1.4.7
Routing entry for 10.1.4.0/24
  Known via "static", distance 1, metric 0
  Routing Descriptor Blocks:
  * 10.1.2.2
      Route metric is 0, traffic share count is 1

show ip route <destination> asks: for this specific address, which entry wins? It answers with the exact decision the data plane will make. This is the single most useful verification command for the rest of the week, and it removes all guesswork from tracing a table by hand.

A route in the table is not a guarantee of delivery

Troubleshooting — the route exists but pings still fail

Symptom: a user on 10.1.1.0/24 cannot reach 10.1.4.7, yet show ip route 10.1.4.7 shows a valid match via 10.1.2.2. Diagnosis: a route only proves the router intends to forward. Ping the next hop — if 10.1.2.2 itself is unreachable, the router is forwarding correctly into a black hole, because the link is down, the neighbour is misaddressed, or ARP is failing. Check show ip interface brief for the exit interface. Fix: restore reachability to the next hop. If the next hop is healthy and the ping still fails, suspect a missing return route on the far router — the reply needs its own path home, and routing must work in both directions.

What you should retain

One loop per packet: read the destination IP, match a route, forward toward the next hop; no match and no default means drop.
Forwarding is destination-driven — the router never consults the source address to decide.
Layer 3 addresses are end-to-end; the frame's MAC addresses are hop-local and rebuilt at every router.
A next-hop IP is not carried in the packet — it only tells the router whose MAC to ARP for.
Three sources feed the table: connected (C and L), static (S), and dynamic (O, D, R).
show ip route <destination> reveals the exact winning entry for any address.

Pause and predictNot scored — nothing is recorded

Before you read on

Using the table above, name the winning line and the exit interface for each of three destinations, before revealing. (1) 10.1.1.50 (2) 10.1.4.7 (3) 8.8.8.8. Also: what would happen to the third packet if the default route were removed?

Interactive tool

See it happen

Required~12 min

Routing Table Trainer

Run study mode and pick the correct forwarding path for each destination against fresh IOS-style tables. Tracing a table you have already read is easy; tracing one you have never seen is the actual skill, and it only comes from repetition.

Open the tool

Study deeper

Topic guides extend this lesson — they do not replace the first-party walkthrough above.

Routing Protocols

For the fuller treatment of route sources and how the RIB relates to the forwarding table

Open guide

Lesson orientation