Routing Tables & Default Gateways

In one line

Every host and router has a routing table; for each packet it picks the most specific matching route (longest prefix), falling back to the default route.

0/4 · 0%

Think of it like this

Road signs at a junction. 'City centre: left. Airport: right. Everything else: straight on.' The most specific sign that matches your destination wins; 'everything else' is the default route.

Key ideas

01
A route says: 'to reach DESTINATION (a CIDR), send packets via GATEWAY out of INTERFACE'. ip route on Linux shows a connected route for the local subnet (no gateway needed) and a DEFAULT ROUTE default via 192.168.1.1 for everything else.
02
LONGEST-PREFIX MATCH: a /24 route beats a /16, which beats the default 0.0.0.0/0. This is exactly how AWS route tables decide between local, a peering connection, and a NAT gateway (AWS course, Topic 3.2).
03
Routers forward using the same logic. Each hop decrements the IP TTL (Time To Live); at zero the packet is dropped and an ICMP 'time exceeded' message is returned. That's the mechanism traceroute uses to discover each hop.
04
Asymmetric routing (the reply takes a different path from the request) is normal on the internet but breaks STATEFUL devices like firewalls and NAT, which expect to see both directions. It's a subtle cause of 'SYN goes out, nothing comes back'.

Code & diagrams

routes.shbash

ip route                         # the host's routing table
ip route get 8.8.8.8             # which route, gateway, and source IP would be used?
ip route get 10.20.11.5          # a VPC-internal address: is it 'local' or via a gateway?
traceroute -n 8.8.8.8            # hops discovered via TTL expiry

LongestPrefixdiagram

Rendering diagram…

Explain it without notes

A host has routes 10.0.0.0/8 via 10.0.0.1 and 10.20.0.0/16 via 10.20.0.1. Which gateway is used for 10.20.5.5, and for 10.30.5.5?

Practice

Use ip route get for your default gateway, a local device, and a public IP. How does the output differ?

Trade-offs

↔
Static routes are predictable but don't adapt to failures; dynamic routing protocols (OSPF inside networks, BGP between them) adapt automatically but are complex and can propagate mistakes widely (Topic 4.4).

Done when you can

I can read a Linux routing table and explain the default route.
I can apply longest-prefix match by hand.
I know how TTL and ICMP make traceroute work.