Routing Tables and the Default Gateway: How a Packet Picks Its Next Hop

A routing table answers the one question every host and router asks of a packet: where does it go next. The host decides local or remote by its mask and hands the rest to a default gateway; the router prunes its table to one entry by basic match and longest match, with the default route of prefix length zero as the entry of last resort. After reading, you can run the longest-match decision by hand, read a Linux or Windows table line by line, say how a host learned its default (by hand, by DHCP, by Router Discovery or by an IPv6 Router Advertisement) and recognise a missing, dead or rogue default from its symptoms.

View as Markdown

Every device holding an Internet Protocol (IP) packet asks one question first: where does this go next? A routing table answers it. A laptop's table has two or three lines, and the answer is nearly always the default gateway, the router that takes whatever the host cannot deliver itself; a router's table has a line per reachable prefix, and a lookup prunes it to one. The (RFC) series writes both decisions down, RFC 1122 for the host and RFC 1812 for the router. After reading, you can run the longest-match decision by hand, read a Linux or Windows table, say how a host learned its default (by hand, by the Dynamic Host Configuration Protocol (), by Internet Control Message Protocol () Router Discovery or by an IPv6 Router Advertisement (RA)), and recognise a missing, dead or rogue default by its symptoms.

Gateway, router, next hop

The device that forwards between networks (Switch, Router, Firewall) has had two names: RFC 1122 says gateway, and RFC 1812 notes that "Many older Internet documents refer to routers as gateways" (RFC 1812, section 2.2.3), hence the host-side name, default gateway (The Router: From Gateway to Commodity). RFC 1812 calls the route database a routing table or forwarding table (section 2.2.3), names its operational copy the Forwarding Information Base (FIB) (Appendix B) and defines the next hop as "the IP address of the adjacent host or router to which the packet should be sent next", adjacent meaning reachable without crossing a router (section 5.2.4). Each router-to-router handoff is a hop and a fresh lookup, the chain ICMP, ping, and traceroute draws.

The host's decision, as RFC 1122 writes it

The host's duty is one sentence: "If the destination is on a connected network, the datagram is sent directly to the destination host; otherwise, it has to be routed to a gateway on a connected network" (RFC 1122, section 3.3.1). The mask decides, by a mandatory test: if the destination's bits under the mask equal the host's own, it is on-link and the datagram goes to it directly (section 3.3.1.1); the arithmetic is in How IPv4 addresses work, the hardware address in ARP and MAC Addresses. For the remote case the standard describes a route cache, a list of defaults ("The IP layer MUST support multiple default gateways", section 3.3.1.2, each with a preference level, section 3.3.1.6) and optional static routes, "a potential source of failure as configurations change or equipment fails" (section 3.3.1.2). One configured gateway is the usual deployment, but the architecture is a list, and the host must change its mind when its gateway dies.

The router's lookup: basic match, then longest match

RFC 1812 writes the lookup as pruning: candidates start as the whole FIB and each rule discards some; "If the set ever becomes empty, the packet is discarded because the destination is unreachable" (RFC 1812, section 5.2.4.3). Rule 1, Basic Match, keeps the routes whose prefix contains the destination. Rule 2, Longest Match: "the algorithm examines the remaining routes to determine which among them have the largest route.length values. All except these are discarded" (section 5.2.4.3). A host route therefore wins first, network prefixes by decreasing length next, and last the default route, which "is by definition the route whose prefix length is zero" (section 5.2.4.3).

Worked on documentation ranges for a router holding five routes, every row computed with Python's ipaddress module (containment for basic match, largest prefix length for longest match):

0.0.0.0/0          via 192.0.2.1
203.0.113.0/24     via 192.0.2.254
203.0.113.64/26    via 192.0.2.253
203.0.113.70/32    via 192.0.2.252
192.0.2.0/24       dev eth0 (directly connected)

Destination	Basic match keeps	Longest match keeps	Next hop
203.0.113.70	/0, /24, /26, /32	203.0.113.70/32	via 192.0.2.252
203.0.113.65	/0, /24, /26	203.0.113.64/26	via 192.0.2.253
203.0.113.200	/0, /24	203.0.113.0/24	via 192.0.2.254
192.0.2.77	/0, 192.0.2.0/24	192.0.2.0/24	directly, eth0
198.51.100.9	/0 only	0.0.0.0/0	via 192.0.2.1

The rules stop at prefix length. Among survivors of equal length the metric decides, and only within one source: "If route.domain is equal for the two routes and route.metric is strictly inferior for one when compared with the other, then the one with the inferior metric is discarded from the set" (RFC 1812, section 5.2.4.3). Between sources, administrative distance decides, in Static routes, longest prefix match and administrative distance; the entries themselves come from Dynamic routing compared and Route summarization.

The default route: 0.0.0.0/0 and ::/0

The default route has prefix length zero: 0.0.0.0/0 holds all 4,294,967,296 IPv4 addresses (2^32), ::/0 all 2^128 IPv6 addresses. It "MUST be accepted by all implementations" and may be advertised to another routing domain only by explicit configuration (RFC 4632, section 5.1; see Supernetting and route aggregation). Linux spells it default (ip-route(8)); the Windows PowerShell documentation states the equivalence: "The next hop gateway for the default route is also known as the default gateway" (Microsoft Learn, Get-NetRoute, Example 4). In the worked table the default's own next hop, 192.0.2.1, is reached through 192.0.2.0/24, the longer match, not through the default itself: a next hop that is not adjacent is a line with no exit.

How a host learns its default

By hand, a method RFC 1122 requires every host to offer (RFC 1122, section 3.3.1.6).

By DHCP, in the lease (DHCP: the Lease Lifecycle): the Router option, code 3, "specifies a list of IP addresses for routers on the client's subnet. Routers SHOULD be listed in order of preference" (RFC 2132, section 3.5). The classless static route option 121 can also carry a default, and wins: "If the DHCP server returns both a Classless Static Routes option and a Router option, the DHCP client MUST ignore the Router option" (RFC 3442, DHCP Client Behavior).

By ICMP Router Discovery, from 1991: advertisements carrying router addresses with a lifetime and a preference level, messages that "do not constitute a routing protocol: they enable hosts to discover the existence of neighboring routers, but not which router is best to reach a particular destination" (RFC 1256, section 2). DHCP option 31 tells clients whether to run it (RFC 2132, section 5.6); IPv6 absorbed the idea.

By IPv6 RA, the normal case. The host runs a longest prefix match against its Prefix List to decide on-link or off-link, and off-link "the sender selects a router from the Default Router List" (RFC 4861, section 5.2). The Router Lifetime field puts a router on that list: "A Lifetime of 0 indicates that the router is not a default router and SHOULD NOT appear on the default router list" (section 4.2). Each advertisement resets the entry's timer, "a host MUST retain at least two router addresses and SHOULD retain more" (section 6.3.4), and an expired entry sends its destinations through next-hop determination again (section 6.3.5). The same advertisement carries the prefix (How IPv6 hosts get addresses); the list's Neighbor Cache is in Neighbor Discovery: how IPv6 replaces ARP.

How it fails or is attacked

The dead gateway. "The IP layer MUST be able to detect the failure of a 'next-hop' gateway that is listed in its route cache and to choose an alternate gateway" (RFC 1122, section 3.3.1.4); otherwise datagrams "apparently vanish into a 'black hole'" (section 3.3.1.4). Detection is not pinging: "hosts MUST NOT actively check the status of a first-hop gateway by simply pinging the gateway continuously" (section 3.3.1.4). Then "the IP layer MUST select a different default gateway (assuming more than one default is known)" (section 3.3.1.5). With one configured gateway there is nothing to switch to; First-hop redundancy makes the gateway address a role instead.

No default, two, or a next hop out of reach. A router with no matching route discards the packet and sends an ICMP unreachable (RFC 1812, section 5.2.4.3). With two defaults the host chooses by preference, and a packet takes an extra hop until the router's ICMP Redirect corrects the cache entry (RFC 1122, section 3.3.1.2). And "The specified gateway must be reachable first" (route(8)).

The wrong mask, and the signature. A mask that is too short makes a remote host pass the test of RFC 1122, section 3.3.1.1: the host tries direct delivery and never uses the gateway. Conversely, on-link traffic never touches the gateway, so a wrong, missing or dead default leaves the local prefix working and everything beyond it silent. And the lookup decides only the forward direction: the reply is routed by the far end's table, hop by hop, so the two directions of one conversation may take different paths.

The rogue default. Unauthorised DHCP servers can send "incorrect routing information (including spoof routers, etc.)" (RFC 2131, section 7), and rogue advertisements are often accidents, such as a laptop with connection sharing enabled (RFC 6104, section 2.2); a deliberate one is worse, since the spoofed router "can then selectively examine, modify, or drop all packets sent on the link" (RFC 4861, section 11.1). The defences sit at the switch port: , where "By default, all trunk ports on the switch are trusted and all access ports are untrusted for DHCP snooping" (Juniper, Understanding DHCP Snooping); filters advertisements in the switch by sender address, port, prefixes and router priority (RFC 6105, section 3), though not where "IPv6 traffic is tunneled" (section 5).

How to see it

Linux, live in this sandbox on 19 October 2026 at 01:02 (GMT-3): a host at 192.0.2.2 on 192.0.2.0/24, gateway 192.0.2.1, iproute2 6.1.0.

$ ip route show
default via 192.0.2.1 dev eth0
192.0.2.0/24 dev eth0 proto kernel scope link src 192.0.2.2

$ ip -d route show
unicast default via 192.0.2.1 dev eth0 proto boot scope global
unicast 192.0.2.0/24 dev eth0 proto kernel scope link src 192.0.2.2

The connected prefix came from the interface address (proto kernel), reaches neighbours directly (scope link) and names the source address (src); the default is scope global and, under -d, proto boot, the tag of a route installed at start-up (ip-route(8)); other tags are static, ra and redirect, and a lower metric wins (same page). Then ask the kernel:

$ ip route get 198.51.100.7
198.51.100.7 via 192.0.2.1 dev eth0 src 192.0.2.2 uid 0
    cache

$ ip route get 192.0.2.77
192.0.2.77 dev eth0 src 192.0.2.2 uid 0
    cache

$ ip route get 127.0.0.1
local 127.0.0.1 dev lo src 127.0.0.1 uid 0
    cache <local>

Via the gateway, on-link (no via), local: "Essentially, get is equivalent to sending a packet along this path" (ip-route(8)); the local answer comes from the local table that ip route show table all also prints. This sandbox has no IPv6; an advertisement-learned default would read as below, an illustrative line using only tokens the man page and kernel documentation define (proto ra, the 1024 default of ra_defrtr_metric):

default via fe80::1 dev eth0 proto ra metric 1024 pref medium   (illustrative)

Windows. route print shows the table, and route add 0.0.0.0 mask 0.0.0.0 192.0.2.1 adds a default, the page's example with a documentation address (Microsoft Learn, route). In PowerShell, Get-NetRoute -DestinationPrefix "0.0.0.0/0" returns the default, tagged Dhcp when DHCP supplied it (Microsoft Learn, Get-NetRoute).

A router. FRRouting's show ip route opens with a legend, abridged here:

Router# show ip route
Codes: K - kernel route, C - connected, L - local, S - static,
       R - RIP, O - OSPF, I - IS-IS, B - BGP, ...
       > - selected route, * - FIB route, ...
K>* 0.0.0.0/0 [0/100] via 192.168.119.1, enp13s0, 00:30:22
S> 4.5.6.7/32 [1/0] via 192.168.119.1 (recursive), weight 1, 00:30:22
L>* 192.168.119.205/32 is directly connected, enp13s0, 00:30:22

The bracket is distance over metric, > the selected route, * the one installed in the kernel, (recursive) a next hop that needed its own lookup (FRRouting, Zebra).

The Routing table explainer reads pasted ip route, netstat -rn and route print output and runs this decision over it, step by step (Reading ip route, netstat and route print, field by field walks through the fields); the CIDR / Subnet Calculator (Classless Inter-domain Routing) answers one row's basic match (is 203.0.113.70 inside 203.0.113.64/26), the IPv6 Toolkit does the same for ::/0 and 2001:db8::/32, and the Python playground runs the whole decision: ipaddress.ip_address(d) in ipaddress.ip_network(n), then the largest prefixlen.

What to remember

A host delivers directly when the destination matches its own prefix under its mask, and otherwise hands the packet to a gateway on a connected network.
A router's lookup is pruning: basic match keeps the routes that contain the destination, longest match keeps the longest, an empty set means discard; metrics compare only within one source.
The default route has prefix length zero, 0.0.0.0/0 or ::/0: it matches every address, loses to every longer prefix, and every implementation must accept it.
A host learns its default by hand, by DHCP option 3 (overridden by 121), by ICMP Router Discovery, or by an IPv6 RA with a non-zero Router Lifetime.
RFC 1122 requires multiple default gateways and dead gateway detection; RFC 4861 requires a Default Router List of at least two. A single gateway is a deployment choice, not the architecture.
A wrong, missing or dead default leaves the local prefix working and everything beyond it silent; a next hop that is not adjacent is a route in name only.
Rogue defaults arrive by DHCP or RA, mostly by accident; the defences are DHCP snooping and RA-Guard at the switch port.

This series, in order

This article opens the series Routing. Longest-prefix match decides every forwarding choice; the parts start with reading the table a host or router prints, then show where its entries come from (the link-state protocols inside a network, between networks, the trust it lacks and the origin validation that answers part of it), how the core forwards without a full table, and the three problems routing alone does not solve: noticing a dead link quickly, and sizing the timers that do it, a gateway that cannot fail, and one stream for many receivers.

Reading ip route, netstat and route print, field by field. The same table in three dialects: the keywords of iproute2, the flag letters of netstat and the netmask table of route print, read field by field.
OSPF: the map, the math, and area 0. Every router gets the whole map and runs Dijkstra on it: flooding, areas and the backbone rule, cost.
IS-IS: the routing protocol hiding under the internet. 's link-state twin from the OSI world, which runs the backbones most engineers never name.
BGP: how the internet decides where traffic goes. Autonomous systems, the idea and the attributes: how the internet decides where traffic goes.
BGP: the trust fall the whole internet is standing on. A protocol with no built-in way to tell a true announcement from a false one, and the hijacks that followed.
Route origin validation, worked by hand: Valid, Invalid, NotFound. The RFC 6811 states worked from the rules: which ROAs cover a route, which match it, and why maxLength and AS 0 change the answer.
MPLS: labels, stacks, and the BGP-free core. Multiprotocol Label Switching in three moves (push, swap, pop): how labels let the core forward with only its interior routes, no customer or BGP routes, and isolate thousands of virtual private network customers.
BFD: when a link is up and dead at the same time. Detection in milliseconds instead of tens of seconds, for the failure where the interface stays up.
Sizing BFD timers: the arithmetic of detection. The negotiated interval, the jitter and the detection time worked from RFC 5880, and what faster detection costs.
First-hop redundancy: VRRP, HSRP, and the gateway that is a fiction. A host knows one gateway and cannot fail over: VRRP and HSRP make the gateway a role, not a router.
Multicast: what it costs to not flood. One copy instead of thousands, paid for in state, and failure modes that are not the expected ones.