The server is trying to send the packet to a host on a different subnet, say a host with the address 172.16.10.200. In other words, the packet has a source address of 172.16.11.30 and a destination address of 172.16.10.200. Here's how Windows uses its routing table to decide which route to use this time:
- Windows takes each route from the table and performs a bitwise AND between the destination address in the packet (172.16.10.200) and the bitmask (Netmask) of the route. The results this time are like this:
- For each route, the result of ANDing is compared with the Network Destination field of the route, and a match means the route can be used to forward the packet to its destination address. From our second table above, you can see this time that there is only one match i.e. row one where the route's Network Destination field 0.0.0.0 matches the result of the AND action. So the route that Windows will use to forward the packet to its destination will be the following route:
- Windows now uses the following algorithm to decide what to do next:
- If the route's Gateway field matches the address of one of the network interfaces on the server (or if the Gateway is empty) then Windows sends the packet directly to its destination address using the interface specified in the route.
- If the route's Gateway field does not match the address of any of the network interfaces on the server, then Windows sends the packet to the address in the route's Gateway field.
Condition B is the case here since the route's Gateway field (172.16.11.1) does not match the address assigned to the server's single network card, which is 172.16.11.30. Windows therefore determines that the destination address is on a remote subnet and that means Windows cannot send the packet directly to its destination but must instead forward the packet a router, which will then take care of getting the packet to its destination by forwarding it along further. So in this case, Windows sends the packet to the address shown in the Gateway field of the selected route (172.16.11.1) using the server's 172.16.11.30 network interface.
Once the router at 172.16.11.1 receives the packet, it determines what actions need to be taken next to forward the packet on to its final destination of 172.16.10.200, and of course this depends on whether the 172.16.11.10/24 network is a neighboring subnet to 172.16.11.11/24 (i.e. connected by a single router to it) or a remote network (connected by a series of routers with intermediate networks in between them).