Định tuyến (Routing)Routing

Part of the Network Engineer Roadmap knowledge base.

Overview

Routing is the process of selecting a path for traffic to travel from a source network to a destination network across one or more intermediate devices. Where switching moves frames within a single Layer 2 broadcast domain using MAC addresses, routing moves packets between Layer 3 networks (IP subnets) using IP addresses. A router is the device that performs this job: it receives a packet on one interface, decides where it should go next, and forwards it out another interface — repeatedly, hop by hop, until the packet reaches its destination.

The internet is, at its heart, a colossal exercise in routing. There is no single map of the whole network; instead, hundreds of thousands of routers each hold a partial view and cooperate — through routing protocols — to build a consistent, loop-free set of paths. A packet leaving your laptop to reach a server on the other side of the planet may cross 15–25 routers, each making an independent forwarding decision in microseconds based purely on its local routing table.

Two questions sit at the core of every routing decision:

1. Where is the destination? The router compares the packet’s destination IP against entries in its routing table (see IP addressing and subnetting for how addresses and prefixes work).
2. How do I reach it? The matching entry tells the router the next-hop address and/or the outgoing interface.

This note covers how the routing table works, the difference between static and dynamic routing, the major routing protocol families (distance-vector, link-state, path-vector), the specific protocols you will meet in the field (RIP, OSPF, EIGRP, BGP), and the technologies built on top of routing (MPLS, VRF, and cloud route tables).

Fundamentals

The routing table

Every router (and every host — your laptop has one too) maintains a routing table: an ordered list of known destination networks and how to reach each one. When a packet arrives, the router consults this table to decide the next hop. A single entry contains, at minimum:

• Destination prefix — a network and its mask, e.g. 10.1.2.0/24.
• Next-hop — the IP address of the adjacent router to forward to, e.g. 192.0.2.1.
• Outgoing interface — the local interface the packet leaves through, e.g. GigabitEthernet0/1.
• Metric — a measure of how “good” the route is (lower is better).
• Administrative distance — how trustworthy the source of the route is (lower is better).

You can inspect it directly:

# Linux
$ ip route show
default via 192.168.1.1 dev eth0 proto dhcp metric 100
10.10.0.0/16 via 192.168.1.254 dev eth0
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.50

! Cisco IOS
Router# show ip route
Codes: C - connected, S - static, R - RIP, O - OSPF, D - EIGRP, B - BGP
       * - candidate default

C        192.168.1.0/24 is directly connected, GigabitEthernet0/0
O        10.10.0.0/16 [110/20] via 192.168.1.254, 00:15:22, GigabitEthernet0/0
S*       0.0.0.0/0 [1/0] via 192.168.1.1

In the Cisco output the letter in the left column is the route source (C connected, O OSPF, S static). The bracketed pair [110/20] is [administrative distance / metric].

Longest-prefix match

A destination IP can match several routing-table entries at once. For example, a packet to 10.1.2.5 might match all of these:

The router always chooses the most specific match — the one with the longest prefix (largest mask). Here it picks 10.1.2.0/24. This is the fundamental forwarding rule: longest-prefix match wins. It lets a router carry a broad 0.0.0.0/0 default route as a catch-all while overriding it with more specific routes for particular destinations.

Directly connected vs remote networks

• Directly connected networks are the subnets on the router’s own interfaces. When you assign 192.168.1.1/24 to an interface and bring it up, the router automatically installs a connected route (C) for 192.168.1.0/24. No protocol needed — the router can reach those hosts directly over Layer 2.
• Remote networks are everything else: subnets reachable only through another router. The router learns these either from a human (static routes) or from a routing protocol (dynamic routes), and each remote route points to a next-hop — the neighboring router to hand the packet to.

Forwarding is recursive in spirit: “to reach network X, send to next-hop Y” — and the router must itself know how to reach Y (usually because Y is on a directly connected subnet).

Administrative distance (AD)

A router may learn about the same destination from multiple sources — say, a static route and OSPF and RIP all describe 10.10.0.0/16. It cannot install conflicting entries, so it must pick one. Administrative distance ranks the trustworthiness of the source, independent of the metric. Lower AD wins. Only after AD selects a source does the protocol’s own metric break ties among routes from that same source.

So a static route (AD 1) always beats an OSPF-learned route (AD 110) for the same prefix, regardless of metrics — because you, the operator, are assumed to know best.

Metric

The metric is a value a routing protocol uses to compare its own candidate paths to the same destination and pick the best one. Lower is better. Each protocol measures “best” differently:

• RIP — hop count (number of routers to cross).
• OSPF — cost, derived from interface bandwidth.
• EIGRP — a composite of bandwidth and delay (by default).
• BGP — no single numeric metric; it runs a multi-step path-selection algorithm over attributes.

Control plane vs data plane

• The control plane builds the routing table: it runs the routing protocols, exchanges updates with neighbors, and computes best paths. This is the “thinking” part.
• The data plane (or forwarding plane) actually moves packets. Modern routers compile the routing table (RIB — Routing Information Base) into an optimized forwarding table (FIB), often in hardware (Cisco calls this CEF — Cisco Express Forwarding), so packets are switched at line rate without consulting the full routing logic on every packet.

Key Concepts

Static routing

A static route is a route you configure by hand. The router does not learn it, adapt it, or withdraw it — it stays until you remove it.

! Cisco IOS — reach 10.20.0.0/16 via next-hop 192.0.2.2
Router(config)# ip route 10.20.0.0 255.255.0.0 192.0.2.2

! Default route — "everything else" goes to the ISP gateway
Router(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1

# Linux equivalent
$ sudo ip route add 10.20.0.0/16 via 192.0.2.2
$ sudo ip route add default via 203.0.113.1

The default route (0.0.0.0/0, “quad-zero”) is the ultimate longest-prefix fallback: it matches any destination not covered by a more specific entry. Stub networks and hosts typically carry just one default route pointing at their gateway (“the default gateway”), rather than a full table.

Pros: no protocol overhead, no CPU/bandwidth for updates, fully predictable, more secure (no route injection from neighbors), and precise control over paths. Cons: does not scale (every route on every router by hand), no automatic failover unless combined with tracking (e.g. a floating static route with a high AD as backup), and error-prone in large or changing topologies.

When to use: small networks, stub sites with a single exit, default routes toward an ISP, and as backups. Below is a floating static route — it only installs (AD 5) if the primary path (via OSPF, AD 110… actually lower AD wins, so use AD higher than the primary’s) disappears:

! Primary learned via OSPF (AD 110); this backup installs only if OSPF route is gone
Router(config)# ip route 10.20.0.0 255.255.0.0 198.51.100.2 130

Dynamic routing

Dynamic routing uses a routing protocol so routers automatically discover networks, share what they know with neighbors, and recompute paths when the topology changes (a link fails, a router reboots). The time it takes all routers to agree on a new consistent view after a change is called convergence — a key quality metric for any protocol.

Pros: scales to large networks, adapts automatically to failures, less manual work. Cons: consumes CPU, memory, and bandwidth; adds complexity; and requires securing the protocol against bad or malicious updates.

Distance-vector vs link-state

The two classic families of IGP differ fundamentally in what they share and how they compute paths.

Distance-vector routers trust their neighbors’ summaries; link-state routers build their own complete picture and run Dijkstra to find shortest paths, which avoids most loop problems and converges faster.

IGP vs EGP

• IGP (Interior Gateway Protocol) — runs within a single autonomous system (AS), i.e. a network under one administrative control. Optimizes for fast convergence and best internal path. Examples: OSPF, IS-IS, EIGRP, RIP.
• EGP (Exterior Gateway Protocol) — runs between autonomous systems. Optimizes for policy, scalability, and stability over raw speed. The only EGP in real use today is BGP.

An autonomous system is identified by an AS number (ASN) — a globally unique number (16-bit 1–65535, or 32-bit) assigned by a regional registry (e.g. AS15169 is Google). Your ISP has an ASN; large enterprises that multi-home have one too.

RIP — Routing Information Protocol

RIP is the oldest, simplest dynamic routing protocol — a pure distance-vector IGP.

• Metric: hop count only. Each router adds 1.
• Maximum: 15 hops; 16 = unreachable (infinity). This deliberately small cap limits how far RIP can scale and helps bound the count-to-infinity problem.
• Updates: periodic broadcasts/multicasts of the whole table every 30 seconds.
• Versions: RIPv1 (classful, no mask in updates — obsolete), RIPv2 (classless/VLSM, multicast 224.0.0.9, supports authentication), RIPng (for IPv6).

Router(config)# router rip
Router(config-router)# version 2
Router(config-router)# no auto-summary
Router(config-router)# network 192.168.1.0
Router(config-router)# network 10.0.0.0

Limitations: the 15-hop ceiling, slow convergence, and a hop-count metric that ignores bandwidth (a 10 Gbps 3-hop path loses to a 1 Mbps 2-hop path). RIP survives mostly in labs, tiny networks, and legacy gear. Loop-prevention mechanisms it relies on: split horizon, route poisoning, poison reverse, and hold-down timers.

OSPF — Open Shortest Path First

OSPF is the dominant open-standard link-state IGP (RFC 2328 for OSPFv2/IPv4, RFC 5340 for OSPFv3/IPv6). Every router builds an identical Link-State Database (LSDB) describing the topology, then runs Dijkstra’s SPF algorithm to compute the shortest-path tree to every destination.

How it works:

1. Routers discover neighbors and form adjacencies using Hello packets.
2. Each router describes its links in LSAs (Link-State Advertisements) and floods them to all routers in the area.
3. Every router assembles the LSAs into an identical LSDB.
4. Each router independently runs SPF to build its routing table.

Cost (metric): OSPF cost is reference-bandwidth / interface-bandwidth. With the default reference of 100 Mbps, a 100 Mbps link = cost 1, a 10 Mbps link = cost 10. On modern networks you should raise the reference bandwidth (e.g. to 100000 for 100 Gbps) so fast links are distinguished.

Areas: OSPF scales by dividing a large domain into areas, all connected to a central backbone area 0. LSA flooding is contained within an area; Area Border Routers (ABRs) summarize between areas. This keeps LSDBs small and SPF runs cheap. Special area types (stub, totally stubby, NSSA) further reduce the LSAs injected into edge areas.

DR/BDR: On a multi-access segment (like Ethernet with many routers) OSPF elects a Designated Router (DR) and Backup DR (BDR) to avoid every router forming a full mesh of adjacencies. All routers form adjacency with the DR/BDR only, which reduces LSA flooding from O(n²) to O(n). Election is by highest OSPF priority, then highest Router ID.

Convergence: fast — typically sub-second to a few seconds — because each router already holds the full topology and only needs to re-run SPF when an LSA changes.

! Cisco IOS — OSPF single area
Router(config)# router ospf 1
Router(config-router)# router-id 1.1.1.1
Router(config-router)# auto-cost reference-bandwidth 100000
Router(config-router)# network 192.168.1.0 0.0.0.255 area 0
Router(config-router)# network 10.1.0.0 0.0.255.255 area 0
Router(config-router)# passive-interface GigabitEthernet0/2
!
! Verify
Router# show ip ospf neighbor
Router# show ip route ospf

Note the wildcard mask (0.0.0.255, the inverse of a subnet mask) and the explicit area assignment. passive-interface stops OSPF Hellos on interfaces facing hosts (no routers there), improving security and reducing noise.

EIGRP — Enhanced Interior Gateway Routing Protocol

EIGRP is Cisco’s advanced distance-vector protocol (opened as informational RFC 7868). It behaves like distance-vector (it learns from neighbors, not a full topology) but adds link-state-like speed and loop-freedom via the DUAL (Diffusing Update Algorithm).

• Metric: composite, using bandwidth and delay by default (load and reliability optionally). This makes it bandwidth-aware, unlike RIP.
• Neighbors: forms adjacencies with Hello packets; sends incremental, reliable updates only when something changes — not periodic full-table dumps.
• DUAL terms:
  • Successor — the current best (lowest-metric, loop-free) next-hop; installed in the routing table.
  • Feasible successor — a pre-computed loop-free backup next-hop. If the successor fails and a feasible successor exists, EIGRP switches to it instantly (no recomputation), giving very fast convergence.
  • Feasibility condition — a neighbor qualifies as a feasible successor only if its reported distance to the destination is less than the current successor’s total distance, which guarantees no loop.

! Cisco IOS — named EIGRP configuration
Router(config)# router eigrp CORP
Router(config-router)# address-family ipv4 unicast autonomous-system 100
Router(config-router-af)# network 192.168.1.0 0.0.0.255
Router(config-router-af)# network 10.1.0.0 0.0.255.255
!
Router# show ip eigrp neighbors
Router# show ip eigrp topology

EIGRP converges very fast when feasible successors are available and is simpler to configure than OSPF, but it is (historically) Cisco-centric, so it is common in all-Cisco enterprises and rare in multi-vendor or service-provider cores.

BGP — Border Gateway Protocol

BGP (version 4, RFC 4271) is the routing protocol of the internet — the only EGP in use. It is a path-vector protocol: instead of a simple metric, it advertises the full AS-path (the list of autonomous systems a route traverses), which both enables policy and prevents loops (a router rejects any route whose AS-path already contains its own ASN).

eBGP vs iBGP:

Because iBGP does not re-advertise routes learned from one iBGP peer to another (to prevent loops without an AS-path change), a naive iBGP design requires a full mesh of peerings. Large ASes solve this with route reflectors or confederations.

Key BGP path attributes (used to select the best path, in Cisco’s decision order — highest wins unless noted):

1. Weight (Cisco-only, local to one router) — highest wins.
2. Local Preference — highest wins; set within your AS to prefer an exit point (e.g. prefer the cheaper ISP).
3. Locally originated routes preferred.
4. AS-path length — shortest wins (fewer ASes to cross).
5. Origin type (IGP < EGP < Incomplete).
6. MED (Multi-Exit Discriminator) — lowest wins; a hint to a neighbor AS about which entry point into your AS to prefer.
7. eBGP over iBGP.
8. Lowest IGP metric to the next-hop, then oldest route, then lowest router ID as tiebreakers.

A useful mental model: Local Preference controls how traffic leaves your AS (outbound), while MED and AS-path prepending influence how traffic enters your AS (inbound).

! Cisco IOS — eBGP to an ISP, plus one iBGP peer
Router(config)# router bgp 65001
Router(config-router)# bgp router-id 10.0.0.1
!  eBGP neighbor in the ISP's AS
Router(config-router)# neighbor 203.0.113.1 remote-as 64500
!  iBGP neighbor inside our own AS
Router(config-router)# neighbor 10.0.0.2 remote-as 65001
Router(config-router)# neighbor 10.0.0.2 next-hop-self
!  advertise our public prefix into BGP
Router(config-router)# network 198.51.100.0 mask 255.255.255.0
!
!  prefer the ISP link for outbound traffic via local-pref
Router(config)# route-map PREFER-ISP permit 10
Router(config-route-map)# set local-preference 200
Router(config)# router bgp 65001
Router(config-router)# neighbor 203.0.113.1 route-map PREFER-ISP in
!
Router# show ip bgp summary
Router# show ip bgp

BGP is prized for stability and policy control, not speed: it does not flap paths on every minor change, and updates carry rich attributes so operators can implement complex routing policy (peering vs transit, traffic engineering, prefix filtering). Its scale is immense — the global IPv4 table exceeds 900,000 prefixes.

MPLS and MPLS VPNs

MPLS (Multi-Protocol Label Switching) forwards packets based on short, fixed-length labels rather than by looking up the destination IP at every hop. At the network edge, an ingress router (LER — Label Edge Router) classifies a packet into a FEC (Forwarding Equivalence Class) and pushes a label. Core routers (LSRs — Label Switching Routers) then swap labels and forward along a pre-established LSP (Label-Switched Path) — a fast, table-driven lookup — until the egress router pops the label and forwards natively. Labels are distributed by LDP or by MPLS-aware BGP/segment routing.

Why it matters:

• Speed and simplicity in the core — one small label lookup instead of a longest-prefix IP lookup (less relevant with modern hardware, but the model persists).
• Traffic engineering (MPLS-TE) — steer flows along explicit paths, not just the IGP shortest path.
• MPLS L3VPN — the killer application. A service provider carries many customers’ private IP networks over one shared MPLS backbone, keeping each customer’s routes fully isolated. Customer routes live in per-customer VRFs (below) on the provider edge (PE) routers, are carried across the core as VPNv4 routes via MP-BGP, and use a two-label stack (an outer transport label + an inner VPN label). Customers can even use overlapping private address space because each VRF is a separate routing context.

VRF — Virtual Routing and Forwarding

VRF lets a single physical router hold multiple independent routing tables at once, as if it were several virtual routers. Each VRF has its own routing table, its own set of interfaces, and its own view of the network — traffic in one VRF cannot reach another unless you explicitly leak routes between them.

Uses:

• Multi-tenancy — keep Customer A’s and Customer B’s routes completely separate on shared hardware (the foundation of MPLS L3VPN).
• Overlapping IP space — two departments both using 10.0.0.0/8 can coexist in different VRFs.
• Segmentation and security — isolate guest, corporate, IoT, and management networks at Layer 3.

! Cisco IOS — define a VRF and bind an interface
Router(config)# vrf definition CUSTOMER-A
Router(config-vrf)# rd 65001:100
Router(config-vrf)# address-family ipv4
!
Router(config)# interface GigabitEthernet0/1
Router(config-if)# vrf forwarding CUSTOMER-A
Router(config-if)# ip address 10.1.1.1 255.255.255.0
!
Router# show ip route vrf CUSTOMER-A

The route distinguisher (RD) makes otherwise-overlapping customer prefixes globally unique inside MP-BGP.

Cloud routing

Cloud networks route with route tables attached to subnets rather than routing protocols on physical boxes. In AWS a VPC route table maps destination CIDRs to targets (an internet gateway, NAT gateway, transit gateway, VPC peering connection, or virtual private gateway); the most specific (longest-prefix) match wins, exactly as on a physical router. Route propagation can automatically inject routes learned over a VPN or Direct Connect (via BGP on a virtual gateway) into the route table. GCP and Azure follow the same model with their own naming. This is covered in depth in ./16-cloud-networking.md.

Routing protocol comparison

Best Practices

• Prefer specific, summarized routes. Summarize (aggregate) prefixes at boundaries — OSPF area borders, BGP edges — to shrink routing tables, speed SPF, and contain the blast radius of a flapping link.
• Always have a default route at the edge, but never let a default route leak somewhere it causes a loop or a black hole.
• Use static routes deliberately, not by default. They are perfect for stub links and backups (floating statics), but they do not fail over on their own — pair them with IP SLA / object tracking if a link can go down.
• Set OSPF reference bandwidth consistently on every router (auto-cost reference-bandwidth) so 1/10/100 Gbps links are actually distinguished; otherwise all fast links collapse to cost 1.
• Make host-facing interfaces passive (passive-interface) in IGPs so you do not send Hellos where no routers exist — less noise, smaller attack surface.
• Authenticate routing protocols. Enable MD5/SHA authentication on OSPF, EIGRP, and BGP sessions so an attacker cannot inject false routes.
• Filter BGP aggressively. Apply prefix-lists / route-maps to both inbound and outbound BGP so you never accept or announce prefixes you shouldn’t (a misconfigured filter has caused global internet outages). Set maximum-prefix limits on peers.
• Use Local Preference for outbound and AS-path prepending / MED for inbound traffic engineering — know which lever controls which direction.
• Design for convergence. Tune Hello/dead timers or use BFD (Bidirectional Forwarding Detection) for sub-second failure detection where fast failover matters.
• Watch administrative distance when redistributing between protocols — mismatched AD or uncontrolled redistribution can create routing loops and suboptimal paths. Use route tags and filters when mutual redistribution is unavoidable.
• Isolate with VRFs rather than relying on ACLs alone when tenants or environments must never share a routing table.
• Document and monitor. Keep a source of truth for static routes and BGP policy, and monitor route counts, neighbor states, and convergence events (SNMP, streaming telemetry, syslog).

References

• RFC 2328 — OSPF Version 2
• RFC 5340 — OSPF for IPv6 (OSPFv3)
• RFC 4271 — A Border Gateway Protocol 4 (BGP-4)
• RFC 2453 — RIP Version 2
• RFC 7868 — Cisco EIGRP
• RFC 3031 — Multiprotocol Label Switching Architecture
• RFC 4364 — BGP/MPLS IP Virtual Private Networks (L3VPN)
• Cisco — IP Routing Configuration Guides