A next hop is the IP address of the adjacent router or gateway to which a device forwards a packet so that the packet moves one step closer to its destination. In routing, every route in a routing table pairs a destination prefix with a next hop and an outgoing interface, and the forwarding decision of a router is, in essence, the choice of that next hop.
The concept captures the hop-by-hop nature of IP forwarding: no router knows the complete path across a network. Each one only knows which neighbor should receive the packet next, and the packet reaches its goal because every router along the way makes a consistent local decision.
How a router selects the next hop
A router selects the next hop by performing a longest prefix match of the destination address against its forwarding table and reading the next hop stored with the most specific matching entry. A packet for 10.20.30.40 that matches both 10.0.0.0/8 and 10.20.0.0/16 follows the /16 route, because the longer prefix describes the destination more precisely.
Once the next hop is known, the router must still deliver the frame on the local link. On Ethernet it looks up the MAC address of the next hop in its ARP cache for IPv4, or in its neighbor cache for IPv6, and writes that MAC address into the new frame header. The destination IP address in the packet never changes; only the layer 2 addressing is rewritten at every hop, and the time-to-live or hop limit field is decremented by one.
The following table lists the fields a forwarding entry typically holds and what each contributes to the decision.
| Field | Example value | Role in forwarding |
|---|---|---|
| Destination prefix | 192.0.2.0/24 | Defines which packets the route matches |
| Next hop address | 10.1.1.2 | Neighbor that receives the packet |
| Outgoing interface | GigabitEthernet0/1 | Port used to reach the next hop |
| Administrative distance | 1 for static, 110 for OSPF | Ranks routes learned from different sources |
| Metric | OSPF cost 20 | Ranks routes from the same source |
| Resolved layer 2 address | MAC from ARP or ND | Destination address of the outgoing frame |
Types of next hop in routing tables
Next hops differ in how directly they point at a neighbor, and the difference affects both convergence behavior and troubleshooting. A directly connected next hop lies on a subnet attached to the router, while a recursive next hop is an address that is itself reachable only through another route.
BGP is the classic case of recursion: a route learned over iBGP usually carries the NEXT_HOP attribute of the border router that learned it from an external peer, often tens of hops away. The receiving router must resolve that address through its interior gateway protocol, such as OSPF or IS-IS, before the route becomes usable. If the address cannot be resolved, the BGP route is marked inaccessible and is not installed.
| Next hop form | Typical source | Key behavior |
|---|---|---|
| Directly connected address | OSPF, EIGRP, static routes | Resolved immediately through ARP or ND |
| Recursive address | iBGP, static routes to remote gateways | Requires a second lookup in the routing table |
| Exit interface only | Static routes on point-to-point links | No address resolution needed on serial or tunnel links |
| IPv6 link-local address | OSPFv3, RIPng, router advertisements | Valid only together with the interface name |
| Null interface | Discard routes for aggregates | Silently drops matching traffic to prevent loops |
| Multiple equal next hops | ECMP from OSPF, IS-IS or BGP multipath | Traffic hashed across several neighbors |
A static route that names only an exit interface on an Ethernet segment is a known pitfall: the router then treats every destination as directly connected and sends ARP requests for remote addresses, relying on proxy ARP from the neighbor. Specifying the next hop address together with the interface avoids this behavior.
Next hop compared with related routing concepts
The next hop is a per-route forwarding target, which distinguishes it from several neighboring ideas that are often used loosely as synonyms. The table separates them.
| Concept | Scope | Relationship to the next hop |
|---|---|---|
| Default gateway | Host configuration | The next hop of a host’s 0.0.0.0/0 route |
| Routing table | Whole router | Collection of routes, each with a next hop |
| Hop count | Path length | Number of next hops crossed, used as the RIP metric |
| Path | End to end | Chain of next hops chosen independently by each router |
| Policy-based routing | Selected traffic | Overrides the table to set a different next hop |
The distinction matters in practice. A default gateway is simply one special next hop, and changing it on a host does not change how routers further along the path behave. Equally, policy-based routing sets a next hop from criteria such as source address or application, so two packets to the same destination can leave through different neighbors.
Next hop resolution and redundancy
Modern routers keep next hop information in a structure separate from the prefixes, often called a next hop table or adjacency table, so that thousands of prefixes can share one entry. When a neighbor fails, the router updates a single shared entry instead of rewriting every route, which shortens convergence time considerably.
Redundancy features build on this. Equal-cost multipath installs two to sixty-four next hops for one prefix, depending on platform, and spreads flows by hashing packet headers. Loop-free alternates and other fast reroute mechanisms precompute a backup next hop so that traffic can switch within roughly 50 milliseconds once a link failure is detected, long before the routing protocol finishes recalculating.
On the host side, a first hop redundancy protocol such as VRRP or HSRP presents a virtual next hop address shared by two or more routers. Hosts keep a single default gateway, and the routers decide among themselves which one answers for the virtual address.
Common next hop problems and fixes
Most next hop failures show up as black holes or loops, and the symptoms point quite reliably to the cause. The table summarizes the patterns that network engineers meet most often.
| Symptom | Likely cause | Fix |
|---|---|---|
| BGP route present but not used | NEXT_HOP unreachable in the IGP | Advertise the peering subnet or use next-hop-self |
| Traffic loops between two routers | Each points its route at the other | Correct the static route or route redistribution |
| Static route stays active after a failure | Next hop on a link that remains up | Track the next hop with probes or BFD |
| Large ARP table on the router | Static route to an Ethernet interface only | Add an explicit next hop address |
| IPv6 route rejected | Link-local next hop without interface | Specify the outgoing interface |
A floating static route with a higher administrative distance is a common backup design, but it activates only when the primary route is withdrawn. If the primary next hop sits behind a switch, the local link stays up while the remote router is dead, so reachability tracking with ICMP probes or Bidirectional Forwarding Detection is essential.
In plain words
Think of a parcel moving through a chain of sorting centers. No center knows the whole route to the final address. Each one only knows which center the parcel goes to next, and that next stop is the next hop.
A router works the same way. It reads where a packet is going, finds the best matching entry in its table, and hands the packet to the neighbor named there. Many small local decisions add up to a complete journey across the network.
A real-world example
A regional office connects to headquarters through two links: a fiber line to a router at 10.0.0.1 and a backup LTE router at 10.0.0.5. The network administrator configures the office router with a default route pointing to 10.0.0.1 and a floating default route to 10.0.0.5 with an administrative distance of 250.
At first, a fiber outage goes unnoticed by the router, because the Ethernet link to the local switch stays up and the primary route remains installed. The administrator adds an ICMP probe that tracks 10.0.0.1 every five seconds. During the next outage the probe fails three times in a row, the primary route is withdrawn, and traffic moves to the LTE next hop in about 15 seconds instead of staying black-holed until someone intervenes.