{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"cs/router","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/cs/router/","da":"https://cmaintz.github.io/tech-atlas/da/terms/cs/router/"},"term":{"en":"Router","da":"Router"},"aka":{"en":[],"da":[]},"domain":["cs"],"cluster":"networking","layer":"network","status":"current","summary":{"en":"A device that joins networks together and passes each packet on toward its destination.","da":"En enhed, der forbinder netværk og sender hver pakke videre mod dens destination."},"body":{"formal":{"en":"A device that connects two or more networks and, for each arriving packet, reads the destination IP address and forwards the packet along the best known path.","da":"En enhed, der forbinder to eller flere netværk, og som for hver pakke, den modtager, læser destinationens IP-adresse og sender pakken videre ad den bedste kendte vej."},"plain":{"en":"Like a sorting office at the post - it does not open letters, it just reads the address and sends each one down the right road.","da":"Som en postterminal - den åbner ikke brevene, men læser adressen og sender hvert brev ud ad den rigtige vej."},"inPractice":{"en":"A shipping company's IT operations manager finds that the router at a small branch office still has its factory password and an admin page open to the internet; she changes the password and closes the page to outside access.","da":"Hos et rederi opdager den IT-driftsansvarlige, at routeren på et lille lokalkontor stadig har fabrikkens adgangskode og en administrationsside, der kan nås fra internettet; hun skifter adgangskoden og lukker siden for adgang udefra."},"whyItMatters":{"en":"Routers sit at the borders between networks, so they are natural places to enforce rules about what may pass - and valuable targets for attackers.","da":"Routere sidder på grænserne mellem netværk, så de er oplagte steder at håndhæve regler for, hvad der må passere - og værdifulde mål for angribere."}},"deepDive":{"en":"For each packet, a router strips the incoming link-layer frame, validates the IP header, looks up the destination address in its forwarding table (FIB) using longest prefix match, decrements TTL or hop limit (recomputing the IPv4 header checksum), resolves the next hop's MAC address with ARP or IPv6 Neighbor Discovery and sends the packet out in a new frame. The source and destination IP addresses stay the same end to end unless NAT rewrites them, whereas the MAC addresses change on every hop. If no more specific route matches, the default route (0.0.0.0/0 or ::/0) is used; if there is none, the packet is dropped with an ICMP Destination Unreachable, and a packet whose TTL reaches zero triggers ICMP Time Exceeded.\n\nA router has three logical planes. The control plane builds the routing table (RIB) from directly connected networks, static routes and routing protocols: interior gateway protocols such as OSPF (RFC 2328) and IS-IS within an organisation, and BGP-4 (RFC 4271) between autonomous systems. The best routes are installed in the FIB, which the data plane uses to forward packets, in high-end routers at line rate in dedicated ASICs. The management plane is how administrators and tools reach the device: SSH, SNMP, web interfaces and APIs.\n\nTerminology is loose in practice. A layer-2 switch forwards frames by MAC address within one broadcast domain, a layer-3 switch also routes between VLANs, and the \"router\" in a home or small office is a combined device with a router, NAT, a stateful firewall, a DHCP server, a DNS forwarder, a switch and a Wi-Fi access point. NAT hides internal addresses as a side effect, but it is not a substitute for a firewall policy, and routers filter with stateless access control lists unless they run a firewall feature set.\n\nAttacks on routers target each plane. In the control plane, unauthenticated OSPF or poorly filtered BGP sessions allow route injection and hijacking, countered with protocol authentication, prefix filtering and RPKI route origin validation. In the management plane, default credentials (CIS Controls v8 Safeguard 4.7 covers default accounts) and web interfaces exposed to the internet are recurrent problems: in October 2023 attackers exploited CVE-2023-20198 in the Cisco IOS XE web UI to implant tens of thousands of devices, and the VPNFilter malware found in 2018 infected at least 500,000 small-office and home routers. Hardening means reaching management interfaces only from a dedicated management network, centralised AAA via TACACS+ or RADIUS, SNMPv3 instead of community strings, disabling unused services, logging to a SIEM, keeping configuration backups with change diffs, patching firmware and replacing devices that are end-of-life.","da":"For hver pakke fjerner en router den indkommende frame fra linklaget, validerer IP-headeren, slår destinationsadressen op i sin forwarding-tabel (FIB) efter længste præfiksmatch, tæller TTL eller hop limit ned (og genberegner IPv4-headerens checksum), finder næste hops MAC-adresse med ARP eller IPv6 Neighbor Discovery og sender pakken ud i en ny frame. Kilde- og destinations-IP-adressen er de samme hele vejen, medmindre NAT omskriver dem, mens MAC-adresserne skifter ved hvert hop. Passer ingen mere specifik rute, bruges standardruten (0.0.0.0/0 eller ::/0); findes der ingen, kasseres pakken med en ICMP Destination Unreachable, og en pakke, hvis TTL når nul, udløser ICMP Time Exceeded.\n\nEn router har tre logiske planer. Kontrolplanet opbygger routingtabellen (RIB) ud fra direkte tilsluttede netværk, statiske ruter og routingprotokoller: interne protokoller som OSPF (RFC 2328) og IS-IS inden for en organisation og BGP-4 (RFC 4271) mellem autonome systemer. De bedste ruter lægges i FIB'en, som dataplanet bruger til at videresende pakker - i kraftige routere med fuld linjehastighed i dedikerede ASIC'er. Administrationsplanet er den vej, administratorer og værktøjer når enheden: SSH, SNMP, webgrænseflader og API'er.\n\nBegreberne bruges løst i praksis. En lag 2-switch videresender frames efter MAC-adresse inden for ét broadcast-domæne, en lag 3-switch router også mellem VLAN'er, og \"routeren\" i et hjem eller et lille kontor er en kombineret enhed med router, NAT, stateful firewall, DHCP-server, DNS-videresender, switch og Wi-Fi-adgangspunkt. NAT skjuler interne adresser som en bivirkning, men erstatter ikke en firewallpolitik, og routere filtrerer med tilstandsløse adgangslister (ACL'er), medmindre de kører en firewallfunktion.\n\nAngreb på routere rammer alle tre planer. I kontrolplanet giver OSPF uden autentifikation eller dårligt filtrerede BGP-sessioner mulighed for at indsprøjte og kapre ruter, hvilket modvirkes med protokolautentifikation, præfiksfiltrering og RPKI-validering af ruteoprindelse. I administrationsplanet er standardadgangskoder (CIS Controls v8, safeguard 4.7, dækker standardkonti) og webgrænseflader eksponeret mod internettet tilbagevendende problemer: I oktober 2023 udnyttede angribere CVE-2023-20198 i webgrænsefladen på Cisco IOS XE til at placere implantater på titusindvis af enheder, og malwaren VPNFilter, der blev opdaget i 2018, havde inficeret mindst 500.000 routere i hjem og små kontorer. Hærdning betyder, at administrationsgrænseflader kun kan nås fra et dedikeret administrationsnetværk, central AAA via TACACS+ eller RADIUS, SNMPv3 i stedet for community strings, deaktivering af ubrugte tjenester, logning til en SIEM, backup af konfigurationen med sporing af ændringer, opdatering af firmware og udskiftning af enheder, der ikke længere får opdateringer."},"edges":[{"type":"requires","to":"cs/ip-address","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/packet","confidence":"high","strength":"normal"}],"depth":3,"sources":[{"title":"Kurose & Ross, Computer Networking: A Top-Down Approach","tier":"textbook"}],"draft":true}