Chapter 7: Routing

Interconnects different network IDs by filtering and forwarding traffic based on IP addresses.

Switch: Forwards traffic based on MAC addresses (Layer 2).

Router: Forwards traffic based on IP addresses (Layer 3).

A table that lists known networks and how to reach them (directly connected or via a gateway).

Tells the router where to send traffic if no specific route exists (usually to an ISP’s gateway).

Uses metrics to prioritize paths (lower metric = preferred route).

No, it only changes the MAC address (unless NAT is involved).

Yes (DSL, fiber, etc.)—they only care about the IP layer.

It forwards it via the default route (if one exists).

MAC address.

IP address.

To connect to two or more different networks (each with its own network ID).

A list in the router that tells it where to send packets based on their destination IP addresses.

Destination network, subnet mask, gateway, and interface.

A route used when no other route matches the destination IP, typically forwarding packets to an upstream router or ISP.

Destination and subnet mask are both all 0s (0.0.0.0/0).

It sends it through the default route to the next-hop router.

By sending an ARP request to that device.

Based on the metric value; lower metrics have higher priority.

For redundancy—if one connection fails, the router can switch to the other.

Network Address Translation (NAT) allows multiple devices to share a single public IP.

Created because IPv4 addresses were running out in the 1990s.

The router replaces the private source IP with its public IP, logs the change in a NAT table, and reverses the process for incoming replies.

Hosting servers (e.g., web, email). Maps a public IP/port to a single private device (port forwarding).

A router assigns public IPs from a pool to devices dynamically. If all IPs are used, new devices can’t connect.

The most common NAT type in homes. Uses one public IP + unique port numbers to track sessions.

Breaks end-to-end connectivity (devices behind NAT can’t be directly contacted without port forwarding).

Only 4.3 billion addresses exist, and they were allocated inefficiently in the early internet.

Hides internal IPs from the internet, acting as a basic firewall (devices can’t be directly targeted).

Because the internet requires unique public IPs for routing data between devices.

Private IP addresses like 192.168.x.x.

The router replaces the internal IP with its own public IP and records the translation in a table.

The router checks the NAT table and forwards the packet to the correct internal IP.

Devices outside the network cannot initiate communication with internal devices unless NAT is specially configured.

A one-to-one mapping between a public IP and a private IP, often used for hosting services.

Port forwarding.

A method where multiple internal devices share a limited pool of public IPs, assigned temporarily as needed.

If the pool runs out of IPs, some devices won’t be able to access the internet.

Yes—home routers (Linksys, Netgear) have NAT enabled by default.

Devices on the LAN lose internet access (no IP translation occurs).

ISPs auto-configure routers with NAT + DHCP (plug-and-play).

Enterprises often need direct public IP assignments (e.g., for servers).

WAN IP: Public (e.g., 161.16.513.x from ISP).

LAN IP: Private (e.g., 192.168.13.1 assigned by router).

DHCP (Dynamic Host Configuration Protocol).

Automatically assigns IP addresses (e.g., 192.168.13.100 and up) to internal devices.

Internal devices would lose internet access unless manually configured with public IPs and routing rules.

Because modern routers handle NAT and DHCP automatically, making setup seamless for typical users.

To evade automated scans/attacks targeting common ports (e.g., 80, 443).

Port Forwarding: Static mapping (always open).

Port Triggering: Dynamic (opens ports only after detecting outbound traffic).

To allow external access to a specific internal device (e.g., camera, game server) by mapping a public port to a private IP.

Active FTP uses Port 21 for requests but Port 20 for responses, which SOHO firewalls block by default.

Exposes one internal device to all inbound traffic.

High risk of hacking (no firewall protection).

They phone home to a cloud server, allowing remote access without router config (but sacrifice privacy).

For applications requiring multiple ports (e.g., game servers).

The exposed device becomes a prime target for attacks (often compromised quickly).

Any incoming information that wasn't initiated from inside the network.

A router configuration that allows unsolicited traffic to be sent to a specific device inside the network.

It lets you access internal services (like security cameras or remote desktop) from outside the network.

Forwarding multiple ports at once, useful for games or servers that require many open ports.

Port range forwarding handles a series of ports, while port forwarding maps a single port.

A method that opens ports dynamically based on outbound traffic from inside the network.

FTP uses two ports (20 and 21), and port triggering allows both to work correctly when one is initiated.

A mode where the FTP server responds back on the same port (21), avoiding the need for port triggering.

It forwards all unsolicited internet traffic to one internal device—risky and not recommended.

It exposes a device directly to the internet, making it vulnerable to attacks.

Use port forwarding or VPNs with proper authentication and firewall rules.

192.168.0.1 or 192.168.1.1.

Security—avoids predictable attacks targeting default IPs.

To spoof a device’s MAC (e.g., when ISP locks to a specific MAC).

Connect to LAN → Open browser → Enter router’s IP → Log in with credentials.

Prevents external hacking attempts on the router’s interface.

Fully resets the router to factory defaults.

Only when necessary (security patches/new features) due to bricking risks.

Instability or permanent damage if installed incorrectly.

Default IP, username, and password

Connect via LAN, use DHCP, enter the gateway IP in a browser

ipconfig

The external internet-facing side

Via DHCP from the ISP

Security through obscurity — avoid defaults

DD-WRT

To prevent unauthorized access

Encrypts the connection to the router’s interface

No, unless absolutely necessary

Blocks unsolicited incoming traffic

Restrictions on apps, sites, times, and keywords

It can "brick" the router

SOHO: Plastic, built-in switch/Wi-Fi.

Enterprise: Metal, modular, rack-mounted.

Enterprise networks use dedicated wireless access points (APs) for scalability/security.

Command Line Interface (CLI) (e.g., Cisco IOS).

OSPF, BGP, or EIGRP.

Consumer-grade hardware lacks redundancy/cooling for 24/7 operation.

To addpgrade interfaces (e.g., fiber, copper, SFP+).

SOHO routers (e.g., Linksys, Netgear).

Cisco CCNA/CCNP.

Sends all traffic not matching other routes to the default gateway (e.g., ISP).

Directs traffic to the local machine (testing/internal services).

route print or netstat -r

They require manual updates and lack adaptability to failures.

224.0.0.0/4 (Class D addresses).

ip route [destination] [subnet] [next-hop]

Traffic is dropped (no automatic rerouting).

A routing table is a list of rules that determine where to send data packets based on their destination IP address.

Static routes and dynamic routes.

The default route — used when no other specific route matches.

127.0.0.1; it's used by a computer to send traffic to itself.

It means the destination is reachable directly through the specified interface, without going through a gateway.

Sends the data directly through the NIC (network interface card) without using the default gateway.

By manually specifying which IP ranges should be routed through which gateway or interface.

They require manual configuration and don't adapt to network changes or failures.

An intranet.

The route fails and data cannot be delivered unless manually rerouted.

In small internal networks, labs, or specific use cases where routing doesn’t change often.

Automatically adapts to network changes (e.g., failures, congestion).

Hop count (least number of routers to destination).

A message sent by link-state routers to announce topology changes (e.g., OSPF).

It’s the standardized protocol for routing between autonomous systems (ISPs).

When all routers agree on the network topology (no conflicting routes).

Sends updates only when changes occur (vs. fixed intervals in distance vector).

A network managed by a single organization (e.g., an ISP or large corp).

OSPF (link-state, fast convergence, supports complex metrics).

The state when all routers in a network have accurate and updated routing tables.

Because any change requires manual updates on each router, which is inefficient and error-prone.

A method where routers automatically update their routing tables in response to network changes.

Hop count, MTU, bandwidth, cost, and latency.

Maximum Transmission Unit — it defines the largest packet size that can pass without fragmentation.

High latency due to the long distance data must travel to space and back.

It sends entire routing tables to neighboring routers at regular intervals.

RIP (Routing Information Protocol).

It sends updates only when changes occur, not the entire routing table, and converges faster.

To notify neighboring routers about changes in routing information.

Interior Gateway Protocols (IGP) and Exterior Gateway Protocols (EGP).

BGP (Border Gateway Protocol).

To route data between autonomous systems across the internet.

Autonomous System Numbers (ASNs).

Link-state IGP (Interior Gateway Protocol).

Based on bandwidth (cost = 10⁸/BW in bps).

To reduce LSA flooding by managing updates on multi-access networks.

Link-state changes (e.g., link failure), not periodic intervals.

Uses event-driven LSAs and hierarchical areas for quick convergence.

The backbone area that connects all other areas.

Type 5 (AS External LSA).

Manually set, or automatically chosen as the highest loopback/IP interface.

Messages sent between OSPF routers to advertise the networks they are connected to.

A numerical ID that groups routers in OSPF; it looks like an IP address but has no IP function.

The main router elected to manage LSA communication in a broadcast network segment.

A secondary router elected to take over if the DR fails.

They are elected automatically, though manual configuration is possible.

Faster convergence and more efficient updates—only link changes are advertised, not entire routing tables.

Yes, OSPF fully supports CIDR addressing.

Yes, OSPF integrates well with BGP, especially in larger networks.

Route traffic between autonomous systems (ASes) on the internet.

A 32-bit number (e.g., AS15169) uniquely identifying an autonomous system.

AS Path (shorter path = preferred).

BGP converges slowly (minutes) vs. OSPF (seconds).

Manually prioritize outgoing paths within an AS.

To let ASes control traffic flow (e.g., cost, partnerships).

A physical hub where ASes interconnect to exchange traffic.

Route aggregation (combining subnets into larger blocks).

A hybrid protocol with aspects of both distance vector and link state.

Local Area Networks (LANs) and router networks (owned by ISPs).

Because it can’t handle routing tables with millions of entries — it’s not scalable at a global level.

Autonomous System Number — a 32-bit identifier used to identify each AS on the internet.

Using protocols like OSPF (Interior Gateway Protocols).

Communicate and route traffic between each other across the internet.

Only the location of the BGP router at the edge of its AS.

It only requires routers to know paths to ASes, not to individual LANs or IPs, reducing load and complexity.

Advanced Distance Vector (Cisco proprietary).

Bandwidth + Delay (K1 and K3 weights).

A backup path that meets the feasibility condition (loop-free).

Topology Table (includes successors and feasible successors).

Hello packets (multicast).

Loss of successor and no feasible successor (DUAL recomputes).

"D EX" (in Cisco CLI).

DUAL (Diffusing Update Algorithm).

Enhanced Interior Gateway Routing Protocol.

A distance vector protocol (with link-state characteristics; hybrid).

Bandwidth and latency (composite metrics), hop count.

Neighbor Discovery & Recovery, RTP, DUAL, and PDM.

RTP (Reliable Transport Protocol).

What algorithm does EIGRP use to prevent routing loops and recalculate paths?

Feasibility condition.

The best known path to a destination; added to the routing table.

A backup path that meets feasibility condition; stored in the topology table.

Neighbor router info: IP, interface type, hold-down timer.

All learned routes with their distances and states (active or passive).

Hello, Update, Query, Reply, Request.

Internal = from within same AS; External = from outside AS or static.

To provide gateway redundancy by creating a virtual router shared by multiple physical routers.

GLBP (Gateway Load Balancing Protocol).

224.0.0.2 (UDP port 1985).

VRRP enables preemption by default; HSRP requires manual configuration.

The Active Virtual Gateway assigns MACs to AVFs for load balancing.

VRRP (Virtual Router Redundancy Protocol).

show standby brief

Per-host or round-robin across Active Virtual Forwarders (AVFs).

irst Hop Redundancy Protocol

It ensures continued internet access by providing a backup virtual gateway when the primary router fails.

The first router (default gateway) a device uses to send traffic outside the local network.

As a single virtual IP and MAC address (default gateway), even though multiple routers exist.

A standby router takes over using the same virtual IP/MAC without disrupting service.

HSRP, VRRP, GLBP

Cisco (proprietary)

No, it must be manually enabled.

One active router, one or more standbys.

It supports load balancing, not just failover.

Cisco (proprietary)

Using ARP replies that return different MAC addresses, based on router weights.

IP: 224.0.0.102, Port: UDP 3222