Trace how a router turns a packet's destination IP into a single forwarding action, and prove that decision by reading the matched line in show ip route.
Week 4 · Lesson 1 · Active ~34 min · Optional video ~8 min · Practice ~12 min · Domain: IP Connectivity
You should be able to read a prefix length like /24 as a network boundary and explain how ARP maps an IP to a MAC on a local segment.
Prerequisites: cidr-masks-and-host-ranges, ethernet-mac-arp
Baseline check
A router receives a packet destined for 10.1.4.7. Before reading on, answer two things from memory: (1) which field in the packet does the router use to decide where to send it, and (2) what happens if the router has no entry that covers 10.1.4.7?
Hold onto your two answers. Most of routing is just that decision, repeated at every hop — and the second answer (what happens with no route) is the one learners most often get wrong.
A router has exactly one job per packet: decide where to send it next, then send it. Everything else — protocols, timers, metrics — exists only to fill in the table the router consults for that decision. Strip it down and the loop is:
- A frame arrives; the router de-encapsulates it and reads the destination IP address in the packet header.
- It searches its routing table for the entry that best matches that destination.
- If it finds a match, it forwards the packet out the interface that entry names, toward the next hop that entry names.
- If it finds no match (and has no default route), it drops the packet and sends an ICMP destination unreachable back to the source.
Notice what the router does not look at: the source address. Forwarding is destination-driven. The source only matters for the return trip, which is a separate decision made by the routers on the way back.
The Layer 3 destination is preserved; the Layer 2 header is disposable. This is the single most clarifying idea in routing. As a packet crosses a router, the destination IP written by the original host does not change — 10.1.4.7 stays 10.1.4.7 from the first hop to the last. What changes at every router is the frame: the router strips the incoming Ethernet header, looks up the destination, and builds a new frame with its own interface MAC as the source and the next hop's MAC as the destination. Then it forwards.
So a packet keeps one fixed Layer 3 address (its final destination) while wearing a series of temporary Layer 2 "envelopes," one per link. The next-hop IP in a route is not carried in the packet at all — it exists only so the router knows whose MAC address to put in the new frame, which it resolves with ARP.
Why doesn't the router just use the destination MAC it received?
Because that MAC was only meaningful on the previous link. A host sending off-subnet traffic addresses the frame to its default gateway's MAC, not the final destination's — the destination is on another network the host cannot ARP for. Each router in turn does the same thing: it addresses the outgoing frame to the next router's MAC. The Layer 2 addresses are hop-local by design; only the Layer 3 destination is end-to-end. That separation is exactly what lets one packet cross networks built on different media without the original host knowing anything about the path.
Routing is a decision; forwarding is the action. CCNA separates these deliberately. The control plane builds and maintains the routing table (learning routes, running protocols, picking winners). The data plane is the fast per-packet act of matching a destination and pushing the frame out an interface. When you configure a static route or run OSPF, you are shaping the control plane. When a packet actually moves, that is the data plane using what the control plane decided. show ip route is your window into the control plane's finished product — the set of decisions the router is prepared to make.
The routing table (the RIB) is fed from three sources. A router can only forward toward a destination it has a route for, so where those routes come from matters:
- Connected routes — created automatically for the subnet on every interface that is up/up and has an IP address. No configuration beyond addressing the interface. Coded
C, and their host-specific companions are codedL(local). These are the foundation; the next lesson is devoted to them. - Static routes — manually configured with
ip route. The administrator states the destination prefix and how to reach it. Precise and quiet, but every change is hand-maintained. Covered in Lesson 3 (this week). - Dynamic routes — learned from a routing protocol such as OSPF, which discovers neighbors and advertises reachability so routers converge on paths automatically. This is Week 5.
Each route in the table records four things you must be able to read: how it was learned (the code letter), the destination prefix and length, the administrative distance and metric in brackets [AD/metric], and the forwarding instruction (a next-hop IP, an exit interface, or both). This lesson focuses on the last part — turning a destination into a forwarding instruction. The bracketed [AD/metric] values decide which route is installed when several compete; that tie-breaking is Lesson 5.
Pause and predict
A router's table has entries for 10.1.1.0/24, 10.1.2.0/24, and 10.1.3.0/24, and no default route. A packet arrives for 10.1.9.4. Predict the outcome before revealing.
Reveal answer
The packet is dropped. No entry covers 10.1.9.4 and there is no 0.0.0.0/0 default to catch unmatched destinations, so the router has no forwarding instruction to follow. It discards the packet and returns an ICMP destination unreachable to the source. Routers do not flood, broadcast, or "guess a nearby subnet" — a missing route is a silent-to-the-data, explicit-to-the-source failure. This is the answer to the baseline question that trips people up: absence of a route is a hard stop, not a best effort.
Free CCNA | Routing Fundamentals | Day 11 (part 1) | CCNA 200-301 Complete Course
~8 min
Confirm the lookup-and-forward loop: a destination IP is matched to one routing-table entry and forwarded, while the Layer 2 header is rewritten at each router and the Layer 3 destination stays fixed.
Optional. Skip if the written forwarding trace and the show ip route walkthrough already made the decision clear — the lesson stands on its own without video.
Watch on YouTubeThis video is enrichment, not a requirement. The written trace and the table walkthrough below are the primary path.
Here is a small router's IPv4 table. You will not configure anything yet — the skill is reading a forwarding decision out of it.
Interpret show ip route line by line
R1# show ip route
Codes: C - connected, L - local, S - static, O - OSPF
* - candidate default
10.0.0.0/8 is variably subnetted, 5 subnets, 3 masks
C 10.1.1.0/24 is directly connected, GigabitEthernet0/0
L 10.1.1.1/32 is directly connected, GigabitEthernet0/0
C 10.1.2.0/30 is directly connected, GigabitEthernet0/1
L 10.1.2.1/32 is directly connected, GigabitEthernet0/1
S 10.1.4.0/24 [1/0] via 10.1.2.2
S* 0.0.0.0/0 [1/0] via 203.0.113.1
Read it as a set of forwarding rules:
C 10.1.1.0/24 ... GigabitEthernet0/0— a connected route. Anything for 10.1.1.0/24 is on the LAN off Gi0/0; the router ARPs directly for the host and sends the frame out Gi0/0. No next-hop router is involved.L 10.1.1.1/32 ...— the local route: the router's own interface address as a /32 host route. It exists so the router recognizes traffic addressed to itself. You read it, you do not configure it.S 10.1.4.0/24 [1/0] via 10.1.2.2— a static route. The[1/0]is[AD 1 / metric 0].via 10.1.2.2is the next-hop IP: to reach 10.1.4.0/24, hand the packet to the router at 10.1.2.2. The router looks up how to reach 10.1.2.2 (it is on the connected 10.1.2.0/30 off Gi0/1), ARPs for 10.1.2.2, and forwards out Gi0/1. That second lookup — resolving the next hop against another route — is recursive lookup, developed fully in Lesson 3.S* 0.0.0.0/0 [1/0] via 203.0.113.1— the default route, the "gateway of last resort." The*marks it as a candidate default. It matches any destination, but only wins when nothing more specific does.
You can confirm which line the router would use for a specific destination without tracing the whole table by hand:
R1# show ip route 10.1.4.7
Routing entry for 10.1.4.0/24
Known via "static", distance 1, metric 0
Routing Descriptor Blocks:
* 10.1.2.2
Route metric is 0, traffic share count is 1
show ip route 10.1.4.7 asks the router directly: "for this destination, which entry wins?" It answers 10.1.4.0/24 ... via 10.1.2.2 — exactly the decision the data plane will make. This is the single most useful verification command for the rest of the week.
Use the same table from the walkthrough. For each destination, name the winning line and the exit interface before revealing.
| # | Destination | Which route line matches? |
|---|---|---|
| 1 | 10.1.1.50 | ? |
| 2 | 10.1.4.7 | ? |
| 3 | 8.8.8.8 | ? |
Pause and predict
For each of the three destinations, state: the matching prefix, the forwarding instruction (connected out an interface, or via a next hop), and the exit interface the frame actually leaves through.
Reveal answer
- 10.1.1.50 →
C 10.1.1.0/24on Gi0/0. It is a directly connected LAN host; the router ARPs for 10.1.1.50 and sends the frame out Gi0/0. No next-hop router. - 10.1.4.7 →
S 10.1.4.0/24 via 10.1.2.2. The router must first resolve the next hop: 10.1.2.2 falls in the connected 10.1.2.0/30 off Gi0/1. So it ARPs for 10.1.2.2 and forwards out Gi0/1. The packet's destination stays 10.1.4.7; the new frame is addressed to 10.1.2.2's MAC. - 8.8.8.8 →
S* 0.0.0.0/0 via 203.0.113.1. No specific prefix covers 8.8.8.8, so the default route wins. The packet leaves toward 203.0.113.1 (the gateway of last resort). Without that default, this packet would have been dropped.
The route exists but pings still fail
Symptom. A user on 10.1.1.0/24 cannot reach a server at 10.1.4.7. show ip route 10.1.4.7 on R1 shows a valid match: 10.1.4.0/24 [1/0] via 10.1.2.2. The route is present, yet pings time out.
Isolate. A route in the table only proves R1 intends to forward — it does not prove the path works. Check the next hop and the return path:
R1# ping 10.1.2.2
Success rate is 0 percent (0/5)
The next hop itself is unreachable. R1 is forwarding correctly into a black hole — either the link to 10.1.2.2 is down, the neighbor's interface is misaddressed, or ARP for 10.1.2.2 is failing. show ip interface brief on R1 confirms whether Gi0/1 is up/up.
Fix. Restore reachability to the next hop (bring the link up / correct the neighbor's IP so 10.1.2.2 responds). If the next hop is fine and the forward ping to 10.1.4.7 still fails, suspect a missing return route on the far router: the server's router needs a route back to 10.1.1.0/24, or the reply has nowhere to go. Routing must work in both directions; a present forward route is only half the story.
Reproduce this logic in the Routing Table Trainer: it hands you IOS-style tables and asks you to pick the forwarding path for a given destination — the same skill, drilled against fresh tables.
Run study mode and choose the correct forwarding path for each destination until the lookup is automatic.
Open routing-tableQuick check (3 items) · retrieve
Answer from memory before checking:
- Which address in a packet does a router use to make its forwarding decision, and which address does it ignore?
- As a packet crosses a router, what stays the same and what is rewritten?
- A destination matches no route and there is no default. What does the router do?
Review sheet
- One loop per packet: read the destination IP → match a route → forward toward the next hop / out the interface; no match and no default → drop.
- Destination-driven: the router uses the destination address, never the source, to decide.
- L3 fixed, L2 rewritten: the destination IP is end-to-end; the frame's MAC addresses are hop-local and rebuilt at every router.
- Next-hop IP ≠ packet field: it only tells the router whose MAC to ARP for the new frame.
- Three sources feed the table: connected (
C/L), static (S), dynamic (e.g.O). show ip route <dest>reveals the exact winning entry for any destination.
show ip route match.You know how the router uses the table; next see where the very first C and L entries come from before any route is configured.
Next: Connected and Local Routes