How a router picks a next hop

A router doesn't know the full path to every destination — it only knows, for each packet, which neighboring router to hand it to next: the next hop. It decides using a routing table, matching the packet's destination IP against every entry and picking the longest prefix match — the most specific route that still matches.

DestinationNext hopInterfacePrefix length

Watch a packet cross the network (how traceroute works)

Every IP packet carries a TTL that every router decrements by 1. If TTL hits 0, the router drops the packet and sends back an ICMP Time Exceeded message identifying itself. Traceroute abuses this on purpose: it sends packets with TTL=1, then 2, then 3, deliberately "killing" the packet at each successive hop to map the whole path one router at a time.

NAT: translating addresses at the border

NAT exists because there aren't enough IPv4 addresses for every device to have a public one. A home router gives every device a private address, then rewrites outbound packets to use its single public address — tracking the substitution in a table so replies can be translated back.

Private host
10.0.0.5:51000
NAT router rewrites to
203.0.113.9:40001
Destination sees
Request from 203.0.113.9:40001
Internal addressTranslated (public) addressDestination
10.0.0.5:51000203.0.113.9:4000193.184.216.34:443

When the reply arrives addressed to 203.0.113.9:40001, the router looks up this exact table entry, rewrites the destination back to 10.0.0.5:51000, and forwards it — the private host never sees the public address at all.

Fragmentation: when a packet is too big

If a packet is larger than a link's MTU, a router has to split it into smaller fragments before forwarding. Each fragment gets its own IP header, a copy of the identification field so the destination knows which fragments belong together, and an offset (in 8-byte units) so they can be reassembled in the right order.

FragmentOffset (bytes)Offset field value (8-byte units)Payload sizeMore fragments?

Common ICMP message types

TypeNameUsed for
8Echo RequestWhat ping sends.
0Echo ReplyWhat ping is waiting for.
11Time ExceededTTL hit 0 — exactly what traceroute exploits.
3Destination UnreachableHost, network, or port couldn't be reached.
5RedirectA router telling a host a better next hop exists for this destination.

Common gotchas