How is an IP packet sent to the gateway?

Question

This is some route command output sample:

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.240.1   0.0.0.0         UG    0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1
192.168.240.0   0.0.0.0         255.255.240.0   U     0      0        0 eth2

When my computer wants to send an IP packet with a destination address of 1.2.3.4, the packet is sent through eth0 to the gateway 192.168.240.1. The IP packet contains 2 fields: the source IP and the destination IP. If the source IP is the IP of my computer and the destination IP is 1.2.3.4, how does the router (gateway) know this IP packet is intended to be forwarded by him? Where in the IP packet is the gateway's IP stored?

Answer 1

how does the router (gateway) know this IP packet is intended to be forwarded by him? Where in the IP packet is the gateway's IP stored?

The "next-hop" IP is not directly stored in the packet. When IP is run over a multipoint* link layer, the next-hop IP must be translated to a link-layer address. Then the link layer must ensure that the packet is delivered only to the IP stack of the intended host or router.

When running IP over an Ethernet (or wi-fi) network, the "next-hop" IP is used to determine the destination MAC address for the packet. The destination MAC address is used to filter incoming packets at the receiving host or router and hence prevent unwanted duplication.

* Note that Ethernet links are treated as multipoint from a protocol perspective, even if physically they happen to be point to point.

Answer 2

You correctly identified that the L3 addresses in the packet will identify the Source and Destination IP address of the two end points of the conversation.

What you didn't account for was the L2 addresses, which will identify the Source and Destination MAC address of the current hop along the path.

Take this image for example:

Host A (10.1.1.22) is trying to send data to Host C (10.9.9.44). Host C exists on a foreign network. So Host A will construct a L2 header which will take the packet to the Router. The L2 header includes a Source of Host A's MAC (a2a2) and the Router's MAC (e5e5).

This is what gets the packet to the Router. The Router will then forward it along as necessary.

Note: Prior to the construction of the L2 header, the Host will have to have a Default Gateway configured (which tells Host A the IP of the Router), and will have to have completed ARP to resolve the Router's MAC address. This process is explained further in the video from which the image above is taken.

Disclaimer: I created the video

Answer 3

From https://serverfault.com/a/904385/656791

TL;DR: the gateway's address is only stored in an Ethernet frame that holds that TCP/IP packet

The server->switch->router traffic, as well as server->switch->server traffic, is where IP addressing doesn't actually play any meaningful part. It's the world of underlying protocol, most likely Ethernet. So it's a world that runs on MAC addressing.

So you only need to resolve the confusion that a default gateway is an IP address. Well, it is, kind-of... what is shown to human... but that gateway's IP is only needed to do one thing, that is to ask: who has 192.168.1.1 around here? The answer comes saying the gateway is MAC 88:99:aa:bb:cc:dd:ee:ff. (That's ARP query/response, the translator between the two worlds.) The MAC is what is actually used. Packet goes to that MAC on Ethernet level, despite the fact that it holds a different destination on IP level.

So the packet is marked to go to a chosen gateway by setting the "destination MAC" field of the Ethernet frame. The field determines which gateway on that network will get it, if there are multiple gateways. (The "frame" is an underlying capsule that holds the packet or part of the packet.)

Generalization: while the route tables are The Core of IP protocol, their column which says Next Hop is never implemented with IP addressing when the packet travels the wire. The Next Hop always actually uses Ethernet, MPLS, or other underlying protocol:

 192.168.98.0/24     via 192.168.99.1 dev eth0 |                   |                         | |  <- IP world ->   | <- underlying world  -> | |                  
|                         | ```

Answer 4

The gateway address is only used as reference and it is not been anyhow added to the IP packet at all (well, technically there is a way to add it as part of source route, but this is very uncommon and no one on the Internet does routing based on source) . As you rightfully mentioned, when your computer wants to send something to 1.2.3.4, it simply does this. Upon receiving this IP datagram, the gateway device (typically router) will do the following:

• Check the IP DST field of the IP header. This will be 1.2.3.4
• Check its routing table (or routing policy) about where to route this traffic to
• Forward the packet & decrease the TTL value within the IP header.

The next router will do exactly the same until packet has reached 1.2.3.4

Of course, this is 10,000 foot summary of the process, but I hope it helps you out to understand the mechanics.

EDIT to address your comment:

IP packets that are sent to networks outside local network will never be sent the way you may imagine it. In other words, if your host 192.168.240.2 wants to sent traffic to 1.2.3.4, it will NOT send this traffic unless it has a route to this destination. If there is no route then the default gateway is used. The default route will always contain an address of a device within our local subnet for which an ARP request will get the MAC address so the L2 frame will contain our gateway's MAC address within the DST field. Now.. most operation systems will not start just sending this traffic to ff:ff:ff because this is a security flaw (everyone on local network will receive it). IF however this happens and for whatever reason the traffic is sent this way, then router(s) on the local segment may just proceed with it as per the above explanation. I am saying may because it will depend on the router/vendor process of how do they handle broadcast traffic or BUM (will they forward it or simply discard it). Chances are, the packet will get discarded ...

Answer 5

From the perspective of the network layer, the packet is simply sent to the gateway. End of story.

For that to work across the link layer, the encapsulating frame needs to be addressed to the gateway's link-layer address (usually a MAC address). That MAC is determined by ARP (IPv4) or NDP (IPv6). Unnumbered point-to-point links don't require any addressing.

From another perspective, the routing table lists a gateway in each entry. That gateway needs to be specified by network-layer address. If it would point to a link-layer address, you couldn't use unnumbered interfaces. Also, redundant gateways sharing a virtual IP address like with VRRP couldn't work.

how does the router (gateway) know this IP packet is intended to be forwarded by him?

When a router receives a frame addressed to one of its interface, it extracts the packet and forwards it based on the packet's destination address and its own routing table.

Where in the IP packet is the gateway's IP stored?

Nowhere - that's the beauty of it. A packet finds its way through dozens of routers, across a global network without anything changing in it (apart from the TTL hop counter).

(I'm leaving out NAT on purpose because it wasn't in the plan originally.)