How routing and forwarding really differ

The distinction between routing and forwarding is a distinction between two planes in a network device: the control plane and the data plane.

The control plane is where routing decisions are made. It builds and maintains the routing table by running routing protocols (BGP, OSPF, static configuration) or receiving external route information. The control plane operates on minutes to seconds timescales. It is computationally expensive and relatively slow.

The data plane (also called the forwarding plane) handles individual packets. For each packet, the router reads the destination IP address, looks it up in the forwarding table (derived from the routing table), and sends the packet out the appropriate interface. The data plane operates on microsecond timescales and is often implemented in dedicated hardware (ASICs) for line-rate performance.

Routing is how the router learns what it knows. Forwarding is what the router does with that knowledge for each packet. A routing protocol problem and a forwarding table problem are not the same fault.

A static route is manually configured: the network administrator tells the router "to reach network X, send packets to next hop Y." Static routes are simple and predictable but do not respond to topology changes. If the next hop fails, the static route remains in the table and packets continue being sent to a dead path.

Dynamic routing protocols allow routers to discover, share, and update routes automatically. Two major protocol families are relevant for this module.

OSPF (Open Shortest Path First), defined in RFC 2328, is a link-state interior gateway protocol. Routers using OSPF exchange Link State Advertisements (LSAs) describing their connected networks and link costs. Each router builds a complete map of the network and runs Dijkstra's algorithm to compute the shortest path to each destination. OSPF is used within a single organisation's network.

BGP (Border Gateway Protocol), defined in RFC 4271, is the exterior gateway protocol that interconnects autonomous systems across the internet. An autonomous system (AS) is a network under a single administrative control with a unique AS number. BGP carries path attributes, not just metrics. Route selection considers factors including AS path length, local preference, and origin type.

When a router's forwarding table contains multiple entries that could match a destination address, it uses the most specific match: the entry with the longest prefix (the most bits specified). This is longest prefix match.

Consider a router with two entries for the 10.0.0.0 space: one for 10.0.0.0/16 via interface A, and one for 10.0.1.0/24 via interface B. A packet for 10.0.1.5 matches both entries (10.0.1.5 is within 10.0.0.0/16 and within 10.0.1.0/24). The /24 entry is more specific, so the router forwards the packet via interface B.

This rule is why the Pakistan Telecom incident worked. YouTube's own /22 route was less specific than PTCL's /24 announcement. Every router in the world with both routes in its table chose the /24, because that is the rule, regardless of which announcement was legitimate.

The default gateway is the router a host sends packets to when it has no more specific route for the destination. On a home network, this is typically your router. Your laptop has routes for the local subnet and a default route pointing at the router for everything else.

In routing tables, the default route is written as 0.0.0.0/0. It matches every destination address (since every address starts with zero matching bits), but it is also the least specific possible prefix. Any more specific route will override it via longest prefix match. The default route only handles destinations with no other match.