Step 37. Routing and Gateways — Follow the Letter’s Journey

Level 0 — Getting Comfortable with Computers | Difficulty ★☆☆☆☆ | Estimated time: 2 hours

Prerequisites: Steps 31–36 complete; you understand IP addresses and ports, and the differences among TCP/UDP/ICMP. Work in Windows PowerShell.

• What you need: a Windows PC, PowerShell, an internet connection.
• Caution: today’s practice is 100% safe. Everything is a lookup command. tracert can take tens of seconds to complete — it isn’t stuck, it’s waiting one hop at a time, so let it finish.

Imagine sending a parcel from home. If the destination is in the same neighborhood, one local post office is enough, but if it’s Busan, the parcel goes via the post office in front of your house → the city distribution center → the Busan distribution center. Those "distribution centers passed along the way" are today’s protagonists, routers. So far we’ve learned the letter’s address (IP) and its formats (TCP, UDP, ICMP); today we watch the road that letter actually travels. With a single command, the journey from our house to Google unfolds before your eyes.

1. Learning Objectives

By the end of this chapter, you will be able to:

• Explain what a router and a hop are
• Explain the rule "unknown addresses go to the default gateway first," with an example
• Explain the principle of tracert (the trick of increasing TTL one by one)
• Distinguish asterisks (no response) in a trace result from a real break
• Read the two basic rules in my computer’s routing table

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

2-1. Routers — Signposts Between Networks

The network world is made of countless "neighborhoods." Our home network is one neighborhood, a company intranet is one neighborhood, and Google’s data center is one giant neighborhood. The equipment that connects these neighborhoods to each other is the router. It reads a letter’s address and plays the role of a signpost: "this one needs to go down the right-hand road."

The router in your home is, in fact, a router too. The smallest router — the doorstep connecting our home neighborhood to the big world called the internet.

2-2. Hops — The Name of One Step

Just as a parcel passing one distribution center is called "one step," in networks, passing one router adds 1 hop. Home to Google is usually about 10–20 hops. Even the far side of the planet is reached within twenty steps.

2-3. The Default Gateway — "When in Doubt, Send It Here First"

Your computer doesn’t know the road to every destination. In fact, it knows almost nothing — it knows exactly one thing. "If it’s not the same neighborhood (the same network), send it to the default gateway first."

The default gateway is usually the address of your home router. The computer doesn’t know "the road to Busan," but figures "if I just push it out the front door, the router will handle it somehow." The router in turn asks the ISP’s bigger router, and that router asks the next one. Through this chain of "when you don’t know, ask your superior," the letter advances.

2-4. TTL — The Secret Key of Route Tracing

Remember the TTL (Time To Live) from Step 36. A lifespan number attached to a packet, decremented by 1 for each router passed and discarded at zero. And there’s one more rule: "when a packet dies at zero, the router at that spot reports via ICMP, ‘it died here.’"

Thanks to this rule, the following trick becomes possible. Send with TTL set to 1 → it dies at the first router → that router tells you its address. TTL 2 → the second router tells you. Increasing it one at a time — 1, 2, 3… — reveals the entire list of routers to the destination. This is the principle of the route-tracing tools tracert (Windows) / traceroute (Linux).

3. Follow Along

3-1. Checking My Exit — Seeing the Default Gateway

First, let’s check where my computer’s "front door" is:

ipconfig

Ethernet adapter Ethernet:

   IPv4 Address. . . . . . . . . . . : 172.30.1.54
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 172.30.1.254

(Measured 2026-09-09; only the actually connected adapter portion excerpted. On Korean Windows these appear as IPv4 주소, 서브넷 마스크, 기본 게이트웨이. Your addresses will differ; the 192.168.0.x form is most common.)

How to read the output: the last line, "Default Gateway," is today’s protagonist. It’s the door every packet of mine passes through first when heading to the outside world. Do you also see that my IP in the line above (172.30.1.54) and the gateway (172.30.1.254) share the same front part (172.30.1)? It means they’re the same neighborhood.

Why: all wayfinding starts from "where is my exit?" In the next exercise, we’ll check whether this address appears as the first hop.

3-2. Predict — Who Is the First Hop?

Before the exercise, predict.

Prediction: when we trace the route to Google’s DNS server (8.8.8.8), what address will the first hop (hop 1) be? The default gateway address we just saw, or a completely different, unfamiliar address?

Let’s attach a reason. We learned that "unknown addresses go to the gateway first," so the first router reached must naturally be our home router. Now let’s verify it directly.

3-3. Tracing a Packet’s Journey — tracert

tracert 8.8.8.8

Tracing route to 8.8.8.8 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  172.30.1.254
  2     *        *        *     Request timed out.
  3     3 ms     2 ms     2 ms  211.xxx.xxx.xxx
  4     1 ms     1 ms     1 ms  211.xxx.xxx.xxx
  5     2 ms     3 ms     1 ms  112.xxx.xxx.xxx
  6    10 ms     9 ms     9 ms  112.xxx.xxx.xxx
  7     9 ms    10 ms     9 ms  112.xxx.xxx.xxx
  8    32 ms    33 ms    32 ms  74.125.147.98
  9    33 ms    33 ms    32 ms  142.251.196.73
 10    35 ms    33 ms    34 ms  108.170.233.191
 11    32 ms    34 ms    32 ms  8.8.8.8

Trace complete.

(Measured 2026-09-09. Captured with the -d option, which skips name lookups and finishes faster — tracert -d 8.8.8.8. The addresses in the ISP segment (hops 3–7) are altered sample values; the 74.125, 142.251, and 108.170 ranges at hops 8–10 are Google’s backbone routers. Your hop count, addresses, and times will differ. On Korean Windows it displays in Korean, like 최대 30홉에 대한 경로 추적 and 추적을 완료했습니다.)

How to read the output: the number on the left is the hop number. Hop 1 is, as predicted, our home router (172.30.1.254). Then it passes the ISP’s routers (hops 3–7), enters Google’s backbone network (hops 8–10), and finally arrives at the destination. The ms numbers in the middle are the round-trip time to that hop. Growing larger toward the end is normal — it’s getting farther. Hops 1–7 (inside Korea) are under 10 ms, then jump to 32 ms at hop 8 — you can read the boundary between the "domestic segment" and the "overseas segment" in the numbers.

Why: this one list is physical evidence of the phrase "the internet is a giant relay." You’ve seen with your own eyes the router relay you learned in theory.

3-4. The Mystery of the Asterisks — Routers That Don’t Answer

Look at the measured result above again. Hop 2 really was asterisks:

  2     *        *        *     Request timed out.

Three asterisks mean "that router didn’t send an ICMP notification." The road is not broken. Some routers ignore this notification for security reasons, or because they’re busy. In the measurement too, only hop 2 was silent; from hop 3 on it was normal, and we arrived at the end — there’s simply one quiet distribution center.

Prediction: what if the asterisks continue all the way to the final destination? The hint is in Step 36: we learned that some servers don’t accept ping (ICMP) at all. Asterisks in the middle can be ignored, but asterisks to the very end without "Trace complete" mean there’s a failure at that point. Middle asterisks: ignore. End asterisks: inspect — that one line is enough.

3-5. Same Neighborhood, One Hop — Tracing the Gateway

tracert -d 172.30.1.254

Tracing route to 172.30.1.254 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  172.30.1.254

Trace complete.

(Measured 2026-09-09. Replace the router address with your own.)

How to read it: a same-neighborhood destination takes one hop. It’s a neighbor, so there’s no need to pass through distribution centers. Meanwhile, 8.8.8.8 was eleven steps. With the hop count alone, you can distinguish "same neighborhood" from "a long journey."

Why: Step 32’s ARP (asking neighbors directly) and today’s routing (following signposts for faraway places) meet exactly here. 1 hop = neighbor = solved by ARP. 2+ hops = journey = solved by routers.

3-6. Peeking into My Computer’s Routing Table

Routers aren’t the only ones with guide tables. Your computer also has a small rule table — the routing table:

Get-NetRoute -AddressFamily IPv4

(The output is long, so only the two key lines are excerpted from the measured results.)

DestinationPrefix NextHop      InterfaceAlias
----------------- -------      --------------
172.30.1.0/24     0.0.0.0      Ethernet
0.0.0.0/0         172.30.1.254 Ethernet

(Measured 2026-09-09. On Ubuntu, ip route shows the same content — you’ll see a line like default via 172.30.1.254 ....)

How to read the output:

• 172.30.1.0/24 → NextHop 0.0.0.0 — "Our neighborhood’s addresses (172.30.1.x) are delivered directly, with no next signpost." A NextHop of 0.0.0.0 means "no gateway needed; directly to the neighbor."
• 0.0.0.0/0 → NextHop 172.30.1.254 — "All other addresses (default) are handed to 172.30.1.254 (the gateway)."

Just these two lines are my computer’s entire wayfinding. Same neighborhood: direct. Otherwise: to the gateway. The world’s big routers simply have this table with hundreds of thousands of lines — the principle is the same.

Why: this is the process of confirming that the "default gateway" is not an abstract concept but an actual rule written into the system.

4. Missions & Exercises

Mission — Draw Today’s Hop Map

Take out a notebook and pen. Real paper:

1. Write down my IP and default gateway from ipconfig
2. Run tracert -d 8.8.8.8 and write down hops 1 through the last, nice and big (even if it takes time, wait until the end)
3. Circle hop 1 and label it "our home router"
4. Label the last hop "Google DNS," and label everything in between "the ISP’s and the internet’s routers"
5. If there were asterisks, mark that hop as "a quiet router"
6. Below the drawing, write this sentence: "Unknown addresses go to the gateway first. tracert is the act of demanding introductions from routers by increasing the TTL one at a time."

Exercises

Q1. What is the default gateway, and by what criterion does my computer decide which destinations to send to the gateway?

Q2. Explain the principle by which tracert discovers the routers along a path, citing TTL and ICMP.

Q3. * * * appeared in the middle of a tracert result. When can it be ignored, and when must it be inspected?

Q4. For the same destination, is "more hops = slower" always true? Answer in terms of what the hop count and the ms time each represent.

My computer (172.30.1.54)
   │
   ▼  1 hop
[Our home router] 172.30.1.254  <1ms        ← default gateway
   │
   ▼  2 hops
(A quiet router) * * *                       ← asterisks = no answer, road is alive
   │
   ▼  3~7 hops
ISP routers (211.xxx, 112.xxx ranges) 1~10ms
   │
   ▼  8~10 hops
Google backbone routers (74.125 / 142.251 / 108.170 ranges) 32~35ms
   │
   ▼  11 hops
[Google DNS] 8.8.8.8 32ms  ← Trace complete.

6. Common Pitfalls & Fixes

Wall 1. Ubuntu can’t find the traceroute command

Symptom: command not found: traceroute
Cause: it’s not in Ubuntu’s default installation. An easy tool to miss.
Fix: install it with sudo apt install -y traceroute. Windows’ tracert is built in by default. Also remember that the names are similar but different — Windows is tracert, Linux is traceroute.

Wall 2. The middle is all asterisks and I’m anxious

Symptom: consecutive * * * Request timed out.
Cause: two possibilities. (a) The routers in that segment don’t send ICMP notifications — normal. (b) Everything beyond that point is really cut.
Fix: the distinguishing method is the last line. If the destination IP is printed and it ends with "Trace complete," it’s normal. In the measured environment too, hop 2 was asterisks but we arrived at hop 11. If only asterisks appear to the end with no completion message, there’s a failure at that point.

Wall 3. Hop 1 is not my router’s address

Symptom: tracing from a virtual machine, hop 1 is some other address, not our home router.
Cause: virtual machines are often inside a small virtual neighborhood created by the virtualization program. A VM’s gateway is not the physical router but a virtual router. (The measured computer also had a virtual adapter for WSL holding a separate neighborhood address, 192.168.32.1.)
Fix: it’s nothing strange. The rule "to my gateway first" applies identically in the virtual world. If hop 1 matches the gateway address you checked inside that VM with ipconfig (or ip route), it’s normal.

Wall 4. The hops go past 30

Symptom: the trace stops at 30 hops and never arrives.
Cause: either the tool’s default maximum hop count is 30 and it gave up there (the "over a maximum of 30 hops" in the first line of output is that setting), or the packet is spinning in circles due to a path problem.
Fix: usually the former. Try again with a higher max, like tracert -h 50 8.8.8.8. If it still fails, that destination is behind a network that doesn’t allow tracing.

7. Summary

Today’s Concepts

Today’s Commands

The Instinct That Matters More Than Commands

"Unknown addresses go to the gateway first" — that one line is the whole of internet wayfinding. And tracert is a clever trick that demands a report (ICMP) of "it died here" from each router by raising the TTL 1, 2, 3. Remember the idea of using a rule’s byproduct (the discard report) to draw a map.

Route reading is a skill used identically by attackers and defenders. Attackers use this tool to sketch the outline of a target network (which ISP, where the boundary equipment sits), and defenders use it to find failure segments and watch whether packets detour through unusual paths. Today’s tracing is a legitimate diagnosis open to everyone, but remember clearly the line between "the skill of reading" and "the skill of twisting." And one interesting cell remains on this map — the protagonist of hop 1, the home router. Today we confirmed that this box is "the first signpost," and now it’s time to get curious about what this box does every moment. Paste today’s tracert result into your notebook. When we look inside that box, this paper will serve as your best reference material.

Once every box is checked, Step 37 is complete.