Showing results for 
Search instead for 
Did you mean: 
Rising star
Rising star

When I was scanning the list of topics I had in mind for my first blog, I decided to start off by answering one of popular question that we initially get when we are introduced to the world of networking.

What happened, when router receives packet?


Upon receiving the Packet, router has to follow three generic steps before its routes the packets:

-> Routing

-> Forwarding (Switching)

-> Encapsulation

Let’s discuss each one of them in detail

Routing Process: Routing process is nothing but routers control plane. Router records a routing table listing what route should be used to forward a data packet, and through which physical interface connection. Router learns your network routes information either by static configuration or by using dynamically configure routing protocol like IGP (OSPF, EIGRP, RIP, IS-IS) or though Exterior routing protocol like BGP.

When router receives any packet it has to remove Layer 2 header information present on packet(Example:In Ethernet, source and destination Mac address present on L2 header). Once router remove L2 information it looks for Layer 3 information available on packet that is source and destination IP address.

For moving L3 packet between interfaces, router checks destination address and finds longest-prefix match in IP routing table to find outgoing interface. In IPv4 router uses longest mask to identify best routing entry for forwarding packet.

Example: Let’s assume we have configured 3 different static routes with different subnet mask.

Sh ip route

ip route fa0/2

ip route fa0/1

ip route fa0/0

In above example when router does route lookup for destination address out of 3 entries router will choose longest-prefix length match entry i.e. , because destination address has most common bits matches with selected route and will forward packet out fa0/2.

Destination prefixBinary Splitting 00000001 00000001 00000001
1St Entry 00000001 00000001 00000000
2nd Entry 00000001 00000000 00000000
3rd Entry 00000000 00000000 00000000

Now for any other destination prefix like longest match is and for it would be

Longest match possible in IPv4 routing is /32 ( and shortest match possible is default route i.e.

->If there are multiple routes with same subnet mask learned via same protocol by router then router chooses lowest metric between them.

For Example: Eigrp use composite “metric” and Ospf uses “Cost” for comparison.

->If there is multiple routes with same subnet mask learn via different protocol on router then router chooses lowest administrative distance (AD).

->Last and important point is recursive lookup: which states that whenever there is route lookup more than once it will be termed as recursive lookup. It has to be done by router till destination address point towards any physical or logical interface.


We have a network connected somewhere and we are reaching it by interface fa0/0 having next-hop IP address we can configure static route in two different ways either we can define next-hop IP address i.e. or we can mention interface number fa0/0 as gateway shown below.

ip route

ip route FastEthernet0/0

Both statements look same although both have different meaning.When you point destination address to next hop as exit interface you don’t need further route lookup as router assume destination address is directly connected to that interface. But when you point destination address to any next hop ip address, we need another route lookup also for next hop ip address is referring as recursive lookup.

To get more information on how static route work when you set gateway as Next-Hop IP address or to Next-Hop interface please refer this document.

Forwarding process: It is also known as switching process. Once router finds outgoing interface, packet move between interfaces by switching process. This is done by process switching, fast switching or cef switching. Forwarding can be done by using adjacency tables reside on the route processor or on interface cards that support switching.

-> Process switching requires the device CPU to be involved for every forwarding decision.

-> Fast switching still uses the CPU for initially packets and to fill cache table in router. Once initial packet has been forwarded, the information about how to reach the destination is stored in a fast-switching cache’s .when another packet going to the same destination, the next hop information can be re-used from the cache and so the router processor doesn’t have to look into it, but if the information is not cached the CPU will have to process entire packets.

-> When CEF mode is enabled it build the CEF FIB and adjacency tables reside on the route processor, and the route processor performs the express forwarding.

In switching process device do actual packet link load balancing depending on the methodology we use.

Encapsulation process: L3 header will remain intact unchanged except for nating, vpn etc. layer 2 headers keep changing on hop by hop basis, depending on transmission media. For transmitting L3 packet on wire router need to find out l2 information for packets and it’s depending on the type of media we are using for transmission.

To explain encapsulation process in bit detail, I have created a small topology shown as below in diagram.


As discussed above, depending on the transmission media (In this example transmission media is Ethernet) MAC address in layer 2 headers will keep changing on hop by hop basis.

To generate some traffic, Lets ping from R3 to R2 interface address.As soon as R1 receives the packet from R3, It will remove the L2 information sent by R3 and check the L3 information that is source ( and destination address ( available on packet. Then it will look into its routing table to find out going interface i.e. fa0/0 in above example. Once router identify outgoing interface it will attach L2 header before putting the packet on the wire. So now R1 will attach its own interface Mac address as source and R2’s as destination mac address.

Address resolution protocol (ARP) table on R1:


To get closer packet level overview, I have also attached some packet capture taken on R1's interfaces.

Packet capture on R1’s Fa0/1:


Packet capture on R1’s Fa0/0:


Well!!!! There ends my first blog and I think i managed to brief how routers handle the packet.

Thank you for reading and Hope that is informative


Destination   prefix


Binary Splitting


00000001 00000001 00000001 00000001


1St   Entry


00000001 00000001 00000001 00000000


2nd   Entry


00000001 00000001 00000000 00000000


3rd   Entry


00000001 00000000 00000000 00000000


Very nice document ! ! !


Hi ashirkar,

Nice and clearly explanation.

I have small doubt, But I would like to know, information like any packet reaches in Router what will happen.

As you explained:

1. L2 Header will change (rewrite Happen hop by hop)

2. L3 IP address will change if any NAT or VPN.

It will be greatfull to me if you clear my doubt.

3. Whether TTL field will decrements ?

4. Whether we change the FCS also ?

5. Or any field we are modifying ?




hitesh lodhi

Dear Ashiker,


Please also explain about how and what things check first and last in networking when packet enter from layer 2 to layer 3 like: ACL, QOS, Natting, PBR, Routing...This king of information help to all for troubleshooting.

Ravi VK

Hi ,

Well explained . 

Where can i find such explanation for PPP/PPPOE incase of fixed network.

I want to understand how PPPoE/PPP packet flows from CPE <----> DSLAM <----> BRAS edge router.


Thank you for reading and Hope that is informative

Cisco Employee
Cisco Employee

Very useful and informative basics. It was very helpful.


>When router receive packet it removes L2 header <...>

What happens when  router receive packet with not his MAC in Dest MAC field ?

Seriously, I would like to know...


Hi Ashish, 

Awesome one for the kick start of the New post. I really do appreciate for the detailed explanation whole heartedly as this is very much important to know and understand and also have the knowledge for everyone who are in the field of Networking. 

Novice network engineer will have a good chance to understand about the  " life of the packet traveling from one place to another ". 

If possible, Could you attempt the below: 

  Does two Different Vlans communicate with each other without any interference of L3 device or MLS switch ? 

  to be precise:  

 Number of Vlans: 2

 Description  : Vlan 10, Vlan 20

 Network device in between : Two L2 Switches. 

 Query : Is communication possible between the two vlans without any L3 or MLS switch in between ? 

Thank You, 


Raja. V

Girish Dhanaraj

Without MLS or L3 switch it is not possible to switch the packet between different bridge domain.

Shantha Kumar Selvaraj
Cisco Employee
Cisco Employee

Nice explanation,Great Job!

Quick question,

1. Fast Switching: how does the router knows if the destination network is already available in route cache? does that mean route cache lookup is done first

Packet enters router interface F0/0 ---> Route cache lookup --> Route not available in route cache --> CPU query for decision


Shantha Kumar Selvaraj
Cisco Employee
Cisco Employee


  1.  When router(let's say R1) receives a packet it looks at the FCS first,
  2.  if all looks good,it looks at the L2 Header,which is Destination MAC and Source MAC
  3. IF MAC is not of R1's interface then it drops
  4. But if the MAC address is not of R1's interface but a broadcast or multicast it accepts the packet and removes L2 header,starts looking at IP header for further processing

Shantha Kumar Selvaraj
Cisco Employee
Cisco Employee


3. Yes TTL will decrement by 1,if the TTL  was  already = 1 when router received the packet it will discard the packet and reply the sender that TTL expired,which is the technique used by trace route to find the path taken by a packet.

4.Yes FCS will change aswell,think of FCS as same as checksum,every time a frame is forwarded from a different source to destination device it has to be new CRC check.


Hi, i'm new to this forum and i liked this explenation

please also explain (as hitesh lodh said) about how and what things check first and last in networking when packet enter from layer 2 to layer 3 like: ACL, QOS, Natting, PBR, Routing...This king of information help to all for troubleshooting.

In which order those features are processing

thank a lot, grat work, keep going


Dear Ashish Shirkar,


Nice examples and well explanation !!!!


Dear Ashish Shirkar,


Thanks for your awesome explanation!

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: