Routing¶

Exercise routing-annex.pdf · PDF

You open a web page hosted in California. Your packet leaves your PC, crosses maybe fifteen boxes in different countries, and arrives in a fraction of a second. Here is the surprising part: none of those boxes knows the whole way to California. Each one only knows which way to push the packet next. So how does it ever arrive?

For a week your group has lived on an island: 10.G.0.0/24. There are eight islands in this classroom and no bridges between them. Your PC cannot reach the PC of the group next to you, even though the cable runs under the same table. Today you build the roads.

The signpost¶

Routing is the job of choosing where to send a packet next so that, junction after junction, it reaches its destination.

We keep one analogy for the whole page: road signs at a junction.

A router is a junction. It does not know the whole trip to anywhere. It only has a signpost: "for these addresses, take that exit". The next junction has its own signpost, and decides again. A packet crosses the world one signpost at a time. Each router it passes through is called a hop.

The signpost has a technical name:

A routing table is the list of rules a device uses to decide where each packet goes next. Each line says: "for this destination network, send it out this way".

flowchart LR
    PC["<b>Your PC</b><br>first signpost"] -->|"hop 1"| R1["<b>Router A</b><br>a junction"]
    R1 -->|"hop 2"| R2["<b>Router B</b><br>another junction"]
    R2 -->|"hop 3"| DST["<b>Destination</b>"]

Your PC has a signpost too¶

Every host has a routing table, not only routers. Look at yours on Linux:

ip route

default via 10.3.0.1 dev enp3s0 proto dhcp metric 100
10.3.0.0/24 dev enp3s0 proto kernel scope link src 10.3.0.199 metric 100

Two lines, two signs. Read them from the bottom:

default is short for 0.0.0.0/0: the network that contains every address. It is the sign that says "all other directions".

You can ask the kernel which sign it would use for a given address:

ip route get 10.3.0.50
ip route get 10.5.0.20

The answer for 10.3.0.50 has no via: it is in your own network, so it goes direct. The answer for 10.5.0.20 says via 10.3.0.1: it goes to the gateway. That is the whole decision a PC ever makes. How does it know whether an address is "in my network"? It applies its mask, exactly as you did by hand in Subnetting.

A router has more signs¶

A router works the same way, it just has more lines. On RouterOS:

/ip route print

    DST-ADDRESS       GATEWAY      DISTANCE
DAC 10.3.0.0/24       bridge-lan          0
DAC 10.3.10.0/24      vlan10              0
DAC 10.3.20.0/24      vlan20              0

The letters on the left are flags:

Now a packet for 10.5.0.20 arrives. Which line matches? None. The router has no sign for it, so it drops the packet. That is exactly why the islands are islands.

When several lines match: the most specific wins¶

Often more than one line contains the destination. The router does not take the first one in the list. It takes the line with the longest mask, the most precise one:

10.5.20.0/24   beats   10.5.0.0/16   beats   0.0.0.0/0

Think of a signpost that says "Palma" and another that says "Palma, Calle Sindicato". If you are going to Calle Sindicato, you follow the more precise one. The default route only wins when nothing else matches.

Joining the islands: static routes¶

To connect the classroom, every group's router gets a second leg in a shared network in the middle: the backbone, 172.16.0.0/24. Each group router has the address 172.16.0.G on ether1; the teacher's router is 172.16.0.254.

flowchart LR
    subgraph G3 ["Group 3 island"]
        LAN3["<b>10.3.0.0/16</b><br>LAN + VLANs"]
        R3["<b>G3 router</b><br>172.16.0.3"]
        LAN3 --- R3
    end
    subgraph BB ["Backbone 172.16.0.0/24"]
        SW["<b>Backbone switch</b>"]
        T["<b>Teacher router</b><br>172.16.0.254"]
        SW --- T
    end
    subgraph G5 ["Group 5 island"]
        R5["<b>G5 router</b><br>172.16.0.5"]
        LAN5["<b>10.5.0.0/16</b><br>LAN + VLANs"]
        R5 --- LAN5
    end
    R3 ---|"ether1"| SW
    SW ---|"ether1"| R5

Group 3 wants to reach group 5. Group 3's router needs one new sign:

/ip route add dst-address=10.5.0.0/16 gateway=172.16.0.5

Read it aloud: "for anything in 10.5.0.0/16, hand it to 172.16.0.5". Two details matter:

• The gateway must be directly reachable. 172.16.0.5 is on the backbone, a network the G3 router touches. Writing gateway=10.5.0.1 would not work: the G3 router cannot reach that address directly, and RouterOS shows the route as inactive.
• Why /16 and not /24? Group 5 has three subnets: 10.5.0.0/24, 10.5.10.0/24 (dev) and 10.5.20.0/24 (design). One /16 sign covers all three. That is subnetting, read backwards.

In WinBox the same route is IP → Routes → +: Dst. Address 10.5.0.0/16, Gateway 172.16.0.5. Afterwards /ip route print shows it with the flags AS: active and static.

That last sentence is the Internet in miniature: tens of thousands of networks, each run by different people, that agreed to tell each other which addresses they have.

flowchart LR
    A["<b>PC in group 3</b><br>10.3.0.199"] -->|"question: route on G3 router"| B["<b>PC in group 5</b><br>10.5.0.199"]
    B -->|"answer: needs a route<br>on G5 router too"| A

Following the packet: traceroute¶

How do you see the junctions a packet crosses? Every IP packet carries a counter called the TTL (Time To Live). Each router subtracts one from it. When it reaches zero, the router throws the packet away and sends a small note back to the sender: "it died here".

traceroute sends packets with TTL 1, then 2, then 3... and collects the notes. The result is one line per router on the way.

traceroute -n 10.4.0.199

 1  10.3.0.1
 2  172.16.0.4
 3  10.4.0.199

Three lines: your own router, the partner's router, and the PC itself. Three hops, two junctions. The -n option shows numbers only, without looking up names.

If a line shows * * * (stars), no note came back from that hop. On Windows the same tool is called tracert.

Finding the break: three routers in a line¶

In the virtual lab you build this chain alone, with three blank routers:

pc1 --- ether3 [r1] ether2 ----- ether2 [r2] ether3 ----- ether2 [r3] ether3 --- pc3
10.1.0.0/24        172.16.12.0/30              172.16.23.0/30         10.3.0.0/24

The links between routers are /30 networks: they hold exactly two usable addresses, .1 and .2, one for each end. Each router needs a sign for every network it does not touch:

When it works, traceroute -n 10.3.0.11 from pc1 prints four lines: 10.1.0.1, 172.16.12.2, 172.16.23.2, 10.3.0.11.

Then you break it on purpose: remove the route to 10.1.0.0/24 on r3. The ping fails. But a capture on pc3 shows the requests arriving:

tcpdump -n -c 4 -i eth1 icmp

So the way there is fine. The way back is broken: r3 has no route to 10.1.0.0/24 and drops the answers. That is how a technician thinks: find the exact junction where the packet dies, and in which direction.

Do the whole practice on the Exercise sheet: first read a table on paper, then join your group with a partner group, then the three-router lab.

Key takeaways¶

• A routing table is a signpost: each line says "for this network, go that way". Hosts and routers both have one.
• A host delivers directly inside its own network and sends everything else to its default gateway (0.0.0.0/0).
• When several lines match, the most specific (longest mask) wins; with no matching line, the packet is dropped.
• Connected routes appear by themselves; static routes are typed by you, and their gateway must be directly reachable.
• A ping needs a route there and back: the answer is a new packet.
• traceroute uses the TTL to list one line per router (hop) on the way; switches are invisible to it.

Quick check¶

Next: your islands are joined, but nobody can reach the Internet yet. Find out why the world uses a clever trick instead of routes — NAT and Internet access.