Router

For each packet, a router strips the incoming link-layer frame, validates the IP header, looks up the destination address in its forwarding table (FIB) using longest prefix match, decrements TTL or hop limit (recomputing the IPv4 header checksum), resolves the next hop's MAC address with ARP or IPv6 Neighbor Discovery and sends the packet out in a new frame. The source and destination IP addresses stay the same end to end unless NAT rewrites them, whereas the MAC addresses change on every hop. If no more specific route matches, the default route (0.0.0.0/0 or ::/0) is used; if there is none, the packet is dropped with an ICMP Destination Unreachable, and a packet whose TTL reaches zero triggers ICMP Time Exceeded.

A router has three logical planes. The control plane builds the routing table (RIB) from directly connected networks, static routes and routing protocols: interior gateway protocols such as OSPF (RFC 2328) and IS-IS within an organisation, and BGP-4 (RFC 4271) between autonomous systems. The best routes are installed in the FIB, which the data plane uses to forward packets, in high-end routers at line rate in dedicated ASICs. The management plane is how administrators and tools reach the device: SSH, SNMP, web interfaces and APIs.

Terminology is loose in practice. A layer-2 switch forwards frames by MAC address within one broadcast domain, a layer-3 switch also routes between VLANs, and the "router" in a home or small office is a combined device with a router, NAT, a stateful firewall, a DHCP server, a DNS forwarder, a switch and a Wi-Fi access point. NAT hides internal addresses as a side effect, but it is not a substitute for a firewall policy, and routers filter with stateless access control lists unless they run a firewall feature set.

Attacks on routers target each plane. In the control plane, unauthenticated OSPF or poorly filtered BGP sessions allow route injection and hijacking, countered with protocol authentication, prefix filtering and RPKI route origin validation. In the management plane, default credentials (CIS Controls v8 Safeguard 4.7 covers default accounts) and web interfaces exposed to the internet are recurrent problems: in October 2023 attackers exploited CVE-2023-20198 in the Cisco IOS XE web UI to implant tens of thousands of devices, and the VPNFilter malware found in 2018 infected at least 500,000 small-office and home routers. Hardening means reaching management interfaces only from a dedicated management network, centralised AAA via TACACS+ or RADIUS, SNMPv3 instead of community strings, disabling unused services, logging to a SIEM, keeping configuration backups with change diffs, patching firmware and replacing devices that are end-of-life.