Intuition The one-line pictureA router has two "books": one is the planning book (where the router thinks about all paths and decides the best one) and the other is the action book (a fast lookup of "if packet is for X, send it out this door"). The planning book is the routing table ; the fast action book is the forwarding table . Routing = build the plan; forwarding = execute the plan, per packet.
Definition Routing table (control plane)A routing table is the data structure built by routing algorithms/protocols (e.g. OSPF, RIP, BGP). It holds all the knowledge needed to compute best paths : destination prefixes, next-hop, metric/cost, the protocol that learned the route, administrative distance, etc. It lives in the control plane and changes when topology changes.
Definition Forwarding table (data plane / FIB)A forwarding table (a.k.a. FIB — Forwarding Information Base) is a stripped-down, optimized table derived from the routing table. For each destination prefix it stores just enough to move a packet right now : the outgoing interface and the next-hop address. It lives in the data plane and is consulted for every packet .
Intuition Why TWO tables and not one?WHY: The routing table is rich but slow to search (many fields, multiple candidate routes per destination, updated by protocols). Packets arrive millions/second — you cannot run a routing algorithm per packet. So the router does the heavy thinking once (control plane) and bakes the result into a lean, hardware-searchable table (data plane). Separation = correctness from protocols + speed from hardware.
Intuition The core mechanicA packet carries a 32-bit (IPv4) destination address. The forwarding table stores network prefixes like 192.168.1.0/24. The router asks: "Which prefix in my table matches the most leading bits of this address?" The winner is the longest prefix match (LPM) . That entry tells the outgoing interface.
Worked example Building the mask from a prefix lengthFor /24: M = M = M = = 11111111.11111111.11111111.00000000 = 255.255.255.0 = 11111111.11111111.11111111.00000000 = 255.255.255.0 = 11111111.11111111.11111111.00000000 = 255.255.255.0 Why this step? A /24 reserves 24 bits for the network, so the mask must mark exactly those 24 bits with 1s.
Forwarding table:
Prefix
Out interface
0.0.0.0/0 (default)eth0
10.0.0.0/8eth1
10.20.0.0/16eth2
Packet destined for 10.20.30.40
Check 0.0.0.0/0 → matches (every address matches default).
Why this step? The default route matches everything; it's the fallback.
Check 10.0.0.0/8 → top 8 bits 10 match 10 ✓.
Why? 10.20.30.40 AND /8 mask = 10.0.0.0 = prefix.
Check 10.20.0.0/16 → top 16 bits 10.20 match ✓.
Why? 10.20.30.40 AND 255.255.0.0 = 10.20.0.0 = prefix.
Three matches: lengths 0, 8, 16. Longest = 16 → send out eth2 .
Why? The most specific route is the most precise about where the destination is.
Worked example Worked example 2 — overlapping subnetsTable: 192.168.0.0/16 → A, 192.168.5.0/24 → B, 192.168.5.128/25 → C.
Packet to 192.168.5.200
/16 matches (top 16 bits 192.168)./24 matches (top 24 bits 192.168.5)./25: mask = 25 ones → 255.255.255.128. 192.168.5.200 AND 255.255.255.128 = 192.168.5.128 = prefix ✓ (because 200 = 11001000, top bit of last byte is 1).
Why this step? /25 splits the last byte at 128; addresses 128–255 fall in this half.Lengths 16, 24, 25 → longest = 25 → interface C .
Intuition The "route resolution" stepThe routing table may say "to reach 10.20.0.0/16, go to next-hop 192.168.1.1" . But the data plane needs a physical interface , not just an IP. So the router recursively resolves the next-hop IP down to a directly-connected interface (and MAC via ARP). The resolved (prefix → interface, next-hop) pair is installed into the FIB.
Definition Administrative distance & metric (why the routing table picks ONE)If two protocols offer routes to the same prefix, the routing table breaks ties with administrative distance (trust per protocol, lower = more trusted), then metric (cost within a protocol). Only the winning route is pushed to the forwarding table — that's why the FIB has one entry per prefix .
Common mistake "Routing table and forwarding table are the same thing."Why it feels right: On a tiny home router they look identical and many tools (route -n) show one table. The fix: Conceptually they are different planes — the routing table is the superset of knowledge (multiple candidate routes, metrics, protocol info); the forwarding table is the distilled best-paths used per packet at line rate. On big routers they are physically different memories (RIB in CPU RAM vs FIB in TCAM).
Common mistake "Match the FIRST prefix that matches."Why it feels right: First-match works for ordered access-lists, so people assume routing does it too. The fix: IP forwarding uses longest prefix match , not first match. You must check all matching prefixes and pick the most specific (largest L L L
Common mistake "A longer mask means a bigger network."Why it feels right: "Longer" sounds like "more". The fix: A longer prefix = more network bits = fewer host bits = a smaller network. /24 (256 hosts) is bigger than /25 (128 hosts).
Common mistake "The default route0.0.0.0/0 only matches unknown weird addresses."
Why it feels right: It's called the "default/gateway of last resort". The fix: 0.0.0.0/0 actually matches every address (prefix length 0), but because its length is the smallest, LPM picks it only when nothing more specific matches.
Recall Feynman: explain to a 12-year-oldImagine the post office. The routing table is like the postmaster's big map and notebook where he figures out the best road to every town — he studies it carefully and updates it when roads close. The forwarding table is the little cheat-sheet taped to each sorting machine: "letters starting with these digits → put on truck #3." The machine doesn't think; it just reads the cheat-sheet super fast. And when two labels both fit a letter (one says "Springfield" and a more detailed one says "Springfield, Elm Street"), it always uses the more detailed one. That's longest prefix match!
Mnemonic Remember the split"RIB plans, FIB ships." Routing table = R eason (control plane). Forwarding table = F ast (data plane). And LPM = "Longest is Pickiest = Most-specific."
Recall Active recall checkpoint
Which plane is the forwarding table in? (data plane)
What rule selects the entry? (longest prefix match)
Which entry matches every address? (0.0.0.0/0)
Why two tables? (correctness from protocols + per-packet speed)
What is a routing table (which plane, who builds it)? Control-plane structure built by routing protocols (OSPF/RIP/BGP); holds all candidate routes, next-hops, metrics, administrative distances.
What is a forwarding table / FIB? Data-plane table derived from the routing table; maps each destination prefix to an outgoing interface + next-hop, consulted per packet at line rate.
Why have a separate forwarding table instead of routing per packet? Routing computation is slow & rich; baking best paths into a lean table lets hardware forward millions of packets/sec.
What rule chooses the forwarding entry for a packet? Longest Prefix Match — the matching prefix with the largest prefix length wins.
Matching condition for address D against prefix P/L? (D AND M) == (P AND M) where M is L ones followed by (32-L) zeros (the subnet mask).
What does ANDing the address with the mask accomplish? It zeros out the host bits, leaving only network bits to compare against the prefix.
What does 0.0.0.0/0 match and when is it used? It matches every address (length 0); used only when no more specific prefix matches (default route).
Is /25 a bigger or smaller network than /24? Smaller — more network bits means fewer host bits (128 vs 256 addresses).
What breaks ties between routes from different protocols? Administrative distance (lower = more trusted), then metric within the protocol.
Is IP forwarding first-match or longest-match? Longest prefix match, independent of table order.
Subnet mask for /26? 255.255.255.192 (26 ones = ...11000000 in last byte).
What does route resolution do when installing into FIB? Recursively resolves the next-hop IP to a directly connected outgoing interface (and MAC via ARP).
IP Addressing and Subnetting — masks, prefix lengths, CIDRARP — Address Resolution Protocol — next-hop IP → MAC for the FIBOSPF and Link-State Routing — populates the routing tableDistance Vector — RIP — alternative way the routing table is builtTCAM and Line-rate Forwarding — hardware that stores the FIBDefault Gateway and 0.0.0.0/0 — the catch-all entryControl Plane vs Data Plane — the master distinction
Routing algorithms OSPF RIP BGP
Outgoing interface + next-hop
Intuition Hinglish mein samjhoDekho, router ke paas do tables hote hain aur dono ka kaam alag hai. Pehla hai routing table (RIB) — yeh router ka "soch-vichaar" wala notebook hai. Ismein routing protocols (OSPF, RIP, BGP) saari information bharte hain: kaun se prefix tak jaana hai, next-hop kya hai, metric/cost kitna hai, kis protocol ne route sikhaya. Yeh control plane mein rehta hai aur tabhi update hota hai jab network topology badalti hai. Yeh thoda heavy aur slow hai kyunki ismein bahut saari candidate routes ho sakti hain.
Dusra hai forwarding table ya FIB — yeh "action" wala chhota cheat-sheet hai jo routing table se nikaala jaata hai. Ismein sirf utna hi data hota hai jitna ek packet ko aage bhejne ke liye chahiye: prefix ke liye outgoing interface aur next-hop . Yeh data plane mein hota hai aur har packet ke liye use hota hai, isliye super-fast hona zaroori hai (often TCAM hardware mein). Funda simple hai: RIB plans, FIB ships — ek baar dimaag lagao, phir hardware speed se bhejo.
Ab packet kaise route hota hai? Har packet mein destination IP hoti hai. Router dekhta hai ki uske table ke kaun kaun se prefixes is address ke saath match karte hain — yani top L bits same hain (mask ke saath AND karke compare). Agar kai prefixes match karte hain, toh router Longest Prefix Match lagata hai: jiska prefix length sabse bada (sabse specific) ho, wahi jeetega. Jaise 10.20.30.40 ke liye /16 jeetega /8 se, aur /8 jeetega 0.0.0.0/0 default se. Yaad rakho — yeh "first match" nahi hai, yeh "most specific match" hai, aur longer mask matlab chhota network (zyada network bits, kam host bits).
Yeh important kyun hai? Real internet pe ek router ko har second crores packets forward karne padte hain. Agar har packet pe poora routing algorithm chalega toh router crash ho jaayega. Isliye thinking (control plane) aur doing (data plane) ko alag rakhte hain — correctness protocols se, aur speed hardware se. Exam aur interview dono mein yeh distinction bahut puchha jaata hai!
