A packet leaves your laptop bound for a server on the other side of the planet. Nothing on your laptop knows the whole route — it simply hands the packet to the first router it can reach and trusts the rest of the network to sort it out. That packet will now pass through perhaps fifteen or twenty routers, and at each one, in a few microseconds, a decision is made: which of my outgoing links moves this packet one hop closer to its destination? Get that decision right, billions of times a second, and the Internet works. Get it wrong and packets loop, pile up, or vanish.

This is the job of the network layer: host-to-host delivery of datagrams. The transport layer worries about which program gets the bytes; the network layer's single obsession is getting a packet from this machine to that machine across a mesh of intermediate routers. And the deepest idea on this page is that a router does two utterly different jobs that beginners constantly merge into one — forwarding and routing. Separating them cleanly is the key that unlocks everything else in the network layer.

Two speeds, two questions: the data plane and the control plane

Imagine a giant postal sorting office. On the floor, conveyor belts fling parcels into chutes: a worker glances at each address label, reads a chart pinned to the wall, and drops the parcel down the matching chute. That happens thousands of times a minute — fast, local, mechanical. Meanwhile, up in an office, planners spend the afternoon redrawing that wall chart — deciding, given today's road closures and truck schedules, which chute should feed which onward depot. Two activities, wildly different timescales, and they meet only at the chart on the wall.

A router is exactly this. Its two jobs are:

• Forwarding (the data plane) — the fast, local, per-packet action. A packet arrives; the router reads its destination address, looks it up in the forwarding table, and shoves the packet out the matching output port. This is the parcel worker reading the chart. It must be brutally fast — line rate, often done in hardware — because it happens once per packet, and a busy router sees hundreds of millions of packets a second. Forwarding never computes a route; it only looks one up.
• Routing (the control plane) — the slower, global, network-wide process that computes the forwarding tables in the first place. Routers run routing algorithms among themselves, exchanging information about links and costs, and from that build the table each router will consult. This is the planners redrawing the chart. It runs on a timescale of seconds to minutes, not microseconds.

They meet at exactly one artefact: the forwarding table. Routing writes it; forwarding reads it. This is the single most important sentence on the page — say it twice.

Inside the box: the anatomy of a router

Open a real router and you find four functional pieces. Bytes flow left to right: in through an input port, across a switching fabric, out through an output port — with queues buffering the crush wherever packets arrive faster than they can leave.

• Input ports terminate an incoming link and, crucially, perform the forwarding-table lookup right there — deciding, at line rate, which output port each packet is destined for. Doing the lookup at the input (rather than a central brain) is what lets a router keep up with many high-speed links at once.
• The switching fabric is the router's internal expressway — a crossbar, shared bus, or interconnection network — that physically carries a packet from its input port to its chosen output port.
• Output ports buffer packets and transmit them onto the outgoing link.
• Queues are the buffers that soak up bursts. When two input ports both want the same output port at once, someone must wait — so packets queue. If a queue fills, the router drops packets (this loss is the signal that packet switching and TCP congestion control are built around). Queuing is not a flaw; it is the shock absorber of a statistically multiplexed network.

The lookup itself: longest-prefix match

Now zoom into that microsecond-long lookup. A forwarding table does not hold one row per possible destination address — there are over four billion IPv4 addresses; no table could list them. Instead it holds rows for address prefixes (blocks of addresses, CIDR-style), each pointing at an output link:

A destination address may match several prefixes at once. The rule that breaks the tie is longest-prefix match: choose the matching prefix with the most leading bits specified — the most specific route. An address in 200.23.16.0/23 also sits inside 200.23.16.0/20, but the /23 row is more specific, so it wins. The all-zeros /0 default route matches everything and therefore only wins when nothing else does — it is the fallback. Longest-prefix match is what makes hierarchical addressing and route aggregation possible: a distant router can carry one coarse /20 entry for a whole region while a nearby router carries the fine-grained exceptions.

The demo below is a forwarding-table lookup. It stores each prefix as a (network, mask-length) pair, tests a destination against every row by masking off the host bits, and keeps the match with the longest prefix. This is precisely the decision a router's input port makes, millions of times a second — here in a few lines of pure bit arithmetic.

Read the output carefully: 200.23.16.8 matches both the /20 and the /23, and the /23 wins by being longer; 200.23.20.1 falls outside the /23 so the coarser /20 catches it; and 8.8.8.8 matches nothing specific and drops through to the default route. That is longest-prefix match, live.

What the router reads: the IP datagram header

The address the router matches on lives in the packet's IP header — a compact block of fields prepended to every datagram. You do not need every bit, but a handful matter enormously for how forwarding behaves:

• Source and destination IP addresses — the destination is what longest-prefix match keys on. (Note: ordinary forwarding ignores the source — a packet is routed purely on where it is going.)
• TTL (time to live) — an 8-bit counter that every router decrements by one. If it hits zero, the router discards the packet and sends back an error. TTL is the Internet's seatbelt against routing loops: a packet caught circling forever is guaranteed to die within 255 hops instead of clogging the network eternally. (The traceroute tool is a beautiful hack on exactly this: send packets with TTL 1, 2, 3, … and collect the "TTL expired" complaints to map out every router on the path.)
• Protocol — an 8-bit number naming what's inside the payload (6 = TCP, 17 = UDP, 1 = ICMP). This is how the destination host demultiplexes the datagram up to the right transport protocol — the network-layer echo of a port number.
• Fragmentation fields (identification, flags, fragment offset) — if a datagram is too big for a link's MTU (maximum transmission unit), it can be sliced into fragments that are reassembled at the destination. These fields track which original datagram each fragment belongs to and where it fits. (In IPv6, as you'll see, this job is pushed to the sender and the fields vanish.)
• Header checksum — a lightweight integrity check over the header only. Because TTL changes at every hop, the checksum must be recomputed at every router.