How a packet finds its way

In the junior grade you split 192.168.1.0/24 into smaller subnets and worked out which addresses are on the same link. That answered a question about addresses. It did not answer the next one: a packet leaves your machine with a destination address, and this machine has exactly one cable, one Wi-Fi radio and no idea where the destination physically is. Finding the way is a separate job, done hop by hop by routers.

Every host and every router keeps a routing table: a list of destinations it already knows how to reach. Each entry is a network prefix plus two things — the next hop (which neighbour to hand the packet to) and the outgoing interface (which cable or radio to put it on). Nothing in the table describes the whole path. Each entry describes one step, and the next router holds a table of its own.

$ ip route

default via 192.168.1.1 dev wlan0 proto dhcp metric 600
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.2
192.168.1.0/24 dev wlan0 proto kernel scope link src 192.168.1.42A typical laptop routing table: three entries cover the entire internet.

When a destination matches more than one entry, the router does not use the first match and does not care about the order of the lines. It uses longest prefix match: the entry with more network bits wins, because it is the more specific statement. /32 is a single machine, /24 is one subnet, /16 is a group of subnets, /0 matches every address in existence and is therefore the last resort. That last entry is the default route, and its next hop is the default gateway — usually the router that connects your network to the provider.

destination        next hop        matched by
-----------------  --------------  ------------------
10.8.0.7           direct (tun0)   /24   10.8.0.0/24
10.8.5.7           192.168.1.1     /16   10.8.0.0/16
everything else    192.168.1.1     /0    defaultThe same table, three different destinations.

Forwarding is hop by hop, and every hop repeats the same decision independently. Your machine checks whether the destination is on a directly connected network; if it is not, the packet goes to the gateway. The gateway runs the same check against its own table and hands the packet onward, and so on. Each router rewrites the link layer header — the MAC address of the next hop — but leaves the IP addresses alone. Nothing in the packet records the path it has travelled, which is why a reply can come back by a completely different route.

laptop 192.168.1.42  --ttl 64-->  router 203.0.113.1
router 203.0.113.1   --ttl 63-->  transit 198.51.100.9
transit 198.51.100.9 --ttl 62-->  server 93.184.216.34

reply comes back on a different path: routing is per packet, not per connectionTTL drops at every hop. When it reaches zero the router discards the packet.

TTL exists so that a packet cannot circle forever when two routers disagree. Traceroute turns that safety feature into a measuring instrument. It sends a packet with TTL 1: the first router decrements it to zero and replies with an ICMP time exceeded message, revealing its address. Then TTL 2, then 3, and the answers line up in order. A star instead of an address means that router was configured not to reply — the path still exists, you simply cannot see that hop. This is also why traceroute on a TCP port is the honest test: plenty of networks drop ICMP while forwarding the traffic you actually care about.

$ traceroute -n 93.184.216.34
 1  192.168.1.1      1.204 ms
 2  10.44.0.1        7.881 ms
 3  203.0.113.9     12.115 ms
 4  198.51.100.9    95.402 ms
 5  93.184.216.34  103.771 ms

$ traceroute -n -T -p 443 93.184.216.34
 5  93.184.216.34  103.902 msHops appear in order because TTL grows by one each round.

Inside one organisation, routers learn routes automatically with an interior protocol such as OSPF. Between organisations there is BGP, and the unit is not a router but an autonomous system: one network under one administration, identified by a number such as AS64500. Each AS announces the address blocks it can reach, and its neighbours pass those announcements on, adding their own number to the path. A router therefore holds several possible paths to the same prefix and picks one by policy: path length, commercial agreements, local preference. It holds no map of the internet, only a set of claims about it.

No central machine knows the whole internet. There is a hierarchy of scales instead. Inside your home one router serves one subnet. Your provider runs thousands of routers under a single interior protocol and hides all of it behind one BGP announcement. Above that, a few thousand autonomous systems exchange announcements with each other. Every level needs to know the level below only as one reachable block, and that is the only reason a routing table stays small enough to search in microseconds.