What Is a Router? — The Postal Sorting Office of Networking
A router works exactly like this. It receives data packets, reads their destination IP address, looks it up in its routing table, and forwards the packet out the correct interface — one hop closer to the destination. The packet may cross dozens of routers before it arrives. No single router needs to know the full journey — only the next hop.
A router operates at Layer 3 (Network Layer) of the OSI model. Unlike a switch that forwards frames by MAC address within one network, a router makes intelligent forwarding decisions across different networks using IP addresses. Every time you load a webpage, your packets pass through 10–20 routers on average.
1. Receives an incoming packet on one interface.
2. Looks up the destination IP in its routing table to find the best next hop.
3. Forwards the packet out the appropriate interface, decrementing the IP TTL by 1.
Router Internal Architecture
Routing Table — Longest Prefix Match
When a packet arrives, the router finds the most specific matching route — not just any match. This is called Longest Prefix Match (LPM).
🏭 Animated: How a Router Forwards Packets
The animation below shows a packet travelling from a laptop through three routers to reach a web server. Watch how each router decrements the TTL, looks up the next hop, rewrites the MAC addresses, and forwards the packet.
💡 Each router reads the destination IP, looks up its routing table, rewrites Layer-2 MAC header, decrements TTL and forwards. The IP header (Layer 3) stays intact — only the MAC frame changes.
What Changes at Each Hop?
| Field | Value |
|---|---|
| Source IP | 192.168.1.10 ✓ same |
| Destination IP | 203.0.113.5 ✓ same |
| TTL | Decremented by 1 each hop |
| Protocol | TCP/UDP/ICMP ✓ same |
| Field | Value |
|---|---|
| Source MAC | Router's outgoing port MAC |
| Destination MAC | Next-hop router's MAC |
| Frame scope | Only valid on one link segment |
| Resolved via | ARP (see Section 04) |
If a packet's TTL reaches zero at a router, the router drops the packet
and sends an ICMP Time Exceeded message back to the original sender.
This prevents packets from looping forever inside a misconfigured network. The
traceroute command deliberately exploits this: it sends packets with
TTL=1, 2, 3… forcing each router to reply with ICMP Time Exceeded, mapping the path.
Real-World Context: The Facebook 2021 Outage
Because even Facebook's internal systems relied on the same BGP infrastructure, engineers couldn't remotely access tools to fix it. They had to physically drive to data centres, badge through doors, and manually restore routing. The outage lasted 6 hours and cost an estimated $60 million in revenue. 3.5 billion users were affected.
Source: Facebook Engineering Blog, October 2021; New York Times, "Facebook's Services Are Back Online After a Six-Hour Outage" — Oct 5, 2021.
Types of Routers & NAT
How NAT Works — Network Address Translation
💡 NAT rewrites the source IP+port on outbound packets and reverses the translation on replies. The NAT table maps (private IP : port) ↔ (public IP : port).
ARP — Address Resolution Protocol
IP addresses identify a destination logically. But data travels over physical hardware — Ethernet cables and Wi-Fi — using MAC addresses. Before a device can send a frame to its neighbour, it must answer a critical question: "I know the IP address of the next hop — but what is its MAC address?"
ARP (RFC 826, 1982) solves this. It maps IPv4 addresses to MAC addresses on a local network segment. Every device maintains an ARP cache to avoid broadcasting this question repeatedly.
Everyone hears the shout (broadcast), but only John waves back (unicast reply). Now you know which face belongs to the name. You write it in your notebook (ARP cache) so you don't have to shout again for a while.
ARP Message Format
🏭 Animated: ARP Full Working — Request & Reply
💡 ARP works only on the local subnet. To reach a different network, the host sends an ARP for its default gateway MAC — the router handles the rest.
ARP Edge Cases & Variants
ip proxy-arp).During the 300 Gbps DDoS attack against Spamhaus in 2013 — at the time the largest DDoS in internet history — attackers used ARP cache poisoning alongside DNS amplification to redirect and amplify traffic. ARP's lack of authentication makes it a perennial vector for LAN-level attacks. Source: Cloudflare Blog, "The DDoS That Almost Broke the Internet" — March 2013.
ARP vs NDP — IPv4 vs IPv6
| Feature | ARP (IPv4) | NDP / ICMPv6 (IPv6) |
|---|---|---|
| Protocol | Standalone (EtherType 0x0806) | Part of ICMPv6 (Type 135/136) |
| Discovery method | Broadcast to 255.255.255.255 | Multicast to Solicited-Node address |
| Authentication | None — spoofable | SEND (optional crypto) |
| Router discovery | Requires separate DHCP/ICMP | Built-in (RA/RS messages) |
| Broadcast traffic | High — affects all LAN hosts | Low — targeted multicast only |
| Cache entry name | ARP Cache | Neighbour Cache |
ICMP — Internet Control Message Protocol
IP is a best-effort protocol. It makes no guarantees about delivery. So how does a sender know if something went wrong? Enter ICMP (RFC 792). ICMP is a diagnostic and error-reporting companion to IP — it rides inside IP packets (Protocol number 1) and is used by network devices to report errors, test reachability, and discover path characteristics.
ICMP is not a transport protocol — it carries no user data. It is the network's built-in feedback mechanism. Without ICMP, problems like "no route to host" or "TTL exceeded" would be completely invisible to the sender.
ICMP is encapsulated inside an IPv4 packet with Protocol=1. It is not a transport layer protocol — it has no port numbers, no sessions, no ordering. It is Layer 3 signalling: the network infrastructure talking to itself and to endpoints about what went wrong (or right).
ICMP Message Types
| Type | Code | Name | Triggered By | Used In |
|---|---|---|---|---|
| 0 | 0 | Echo Reply | Response to Type 8 | ping |
| 3 | 0–15 | Destination Unreachable | No route / port closed / filtered | Error detection |
| 4 | 0 | Source Quench (deprecated) | Congestion — router buffer full | Legacy flow control |
| 5 | 0–3 | Redirect | Better route exists via another gateway | Routing optimisation |
| 8 | 0 | Echo Request | User sends ping | ping |
| 11 | 0 | Time Exceeded | TTL reached 0 at router | traceroute |
| 12 | 0 | Parameter Problem | Bad IP header field | Error detection |
| 13/14 | 0 | Timestamp Request/Reply | Clock synchronisation probe | Legacy timing |
Destination Unreachable — Code Details
🏭 Animated: ICMP Echo (ping) — Full Working
💡 Each ping sends ICMP Type 8 (Echo Request). The destination replies with ICMP Type 0 (Echo Reply). RTT = total round-trip time. Three probes shown to simulate a real ping command.
🏭 Animated: traceroute — ICMP Time Exceeded in Action
traceroute exploits ICMP Type 11 (Time Exceeded). It sends packets with
TTL=1 first — the first router drops it and replies "Time Exceeded." Then TTL=2 —
the second router replies. And so on, mapping each hop.
💡 Linux: traceroute uses UDP probes. Windows: tracert uses ICMP Echo Requests. Both exploit the TTL mechanism identically.
ICMP in the Real World — Attacks, Firewalls & Incidents
icmptunnel embed TCP/IP data inside ICMP payload fields, creating a covert channel that bypasses firewalls allowing ICMP but blocking TCP. Used by malware for C2 communication. The 2020 SolarWinds attackers used similar covert channels.Many network admins block all ICMP at the firewall — but this breaks critical functionality. ICMP Type 3 Code 4 (Fragmentation Needed) is essential for Path MTU Discovery — blocking it causes TCP connections to silently stall when crossing links with smaller MTUs. RFC 4890 defines exactly which ICMP types should be permitted through firewalls and which can be safely blocked. The rule: never block Types 3, 11, and 12 from outside. Type 8 (ping) is optional.
Path MTU Discovery — ICMP Type 3 Code 4 in Action
When a large packet hits a smaller MTU link and the DF bit is set, the router returns ICMP Type 3 Code 4, telling the sender to reduce its packet size.
How Routers, ARP & ICMP Work Together
These three protocols are deeply intertwined. When you type a URL, here is the complete sequence that happens before a single byte of webpage arrives:
Quick-Reference Comparison
| Feature | Router | ARP | ICMP |
|---|---|---|---|
| OSI Layer | Layer 3 | Layer 2/3 boundary | Layer 3 |
| Purpose | Forward packets between networks | Resolve IP → MAC on local segment | Error reporting & diagnostics |
| Scope | Inter-network (global) | Local subnet only | End-to-end (global) |
| Transport | IP datagram forwarding | EtherType 0x0806 | IP Protocol 1 |
| Stateful? | Routing table is stateful | ARP cache (soft-state) | Fully stateless |
| Security risk | Route hijacking (BGP) | ARP spoofing / MITM | Ping flood / tunnelling |
| Key tool | ip route, show ip route | arp -a, ip neigh | ping, traceroute |
Golden Rules — Routers, ARP & ICMP
arp -a first when diagnosing
connectivity failures.
ping returning TTL=118
(from a 128-start) means the packet crossed 10 routers. TTL=64 start is Linux/macOS default;
TTL=128 is Windows default. Use traceroute to pinpoint exactly where packets die.
Routers are the post offices of the Internet — they read IP addresses and
forward packets toward their destination, hop by hop.
ARP is the name-to-face lookup — it resolves "I know the IP, what's the
MAC?" on each local link, making physical delivery possible.
ICMP is the network's nervous system — it carries error signals (unreachable,
TTL expired, fragmentation needed) and diagnostic probes (ping, traceroute) that make the
invisible visible. Together, they form the complete foundation of IP networking.