3.2 Static and Dynamic Routing

The previous section assigned IP addresses to devices and subnets. An IP address identifies a device, but it does not tell the network how to reach it. Routing solves this: it is the process of forwarding packets from one network to another based on destination IP address. In an OT network, routing is what allows a SCADA server in one VLAN to reach a PLC in another.

Why Routing Exists

A switch forwards frames within a single network segment. It has no concept of networks beyond its own. When a PLC in 192.168.10.0/24 needs to reach a SCADA server in 192.168.20.0/24, the switch cannot help. It does not know how to reach 192.168.20.0/24.

A router solves this. It connects multiple networks and maintains a routing table: a list of known networks and how to reach them. When a packet arrives, the router looks up the destination IP in its table and forwards the packet toward the destination. The algorithm it uses to find the best match is called longest prefix match.

Longest Prefix Match

When multiple routes match a destination, the router uses the most specific one. This is called longest prefix match.

A /29 route covers 8 addresses. A /0 route covers all 4 billion IPv4 addresses. The /29 is more specific. It was configured for a reason. Using it respects the network designer’s intent. Every device on the network also needs to know where to send packets that are not in its own subnet — that is the default gateway.

Default Gateway

Every end device needs a default gateway: the IP address of the router on its subnet. When a device sends a packet to an address outside its own subnet, it sends the packet to the default gateway.

If the default gateway is wrong or unreachable, the device communicates only within its own subnet. In OT networks, the routing table is almost always configured manually.

Static Routing

Static routes are manually configured entries in the routing table. They do not change unless an administrator modifies them.

Static routing is the standard in OT networks. Industrial networks are small, stable, and change infrequently. The predictability of static routing is a feature, not a limitation.

Hirschmann HiOS:

Routing → Routing Table → Add
Destination: 10.0.0.0  Mask: 255.0.0.0  Next Hop: 192.168.10.1

For larger networks where static routing becomes unmanageable, OSPF provides automatic route discovery.

OSPF: Dynamic Routing for Larger Networks

OSPF (Open Shortest Path First) is a link-state routing protocol. Every OSPF router builds a complete map of the network (the LSDB) and calculates shortest paths using Dijkstra’s algorithm. Use OSPF when the network is too large to manage with static routes, or when automatic failover between redundant paths is required.

Key terms:

• LSDB (Link State Database) — a complete map of the network topology; every OSPF router has an identical copy
• OSPF cost — the metric used by SPF; default = 100,000,000 / interface_bandwidth_bps. All links faster than 100 Mbps get cost 1 with the default reference bandwidth. Set the reference bandwidth to 10,000 Mbps on modern networks.

Whether you use static or dynamic routing, you need a way to verify that the routing table produces the expected behavior.

Verifying Routing Behavior

When debugging a routing problem, you need to know which route a router will use for a given destination. The following function implements the same longest prefix match algorithm a router uses. Run it against your routing table to verify the expected behavior before making changes:

import ipaddress

def longest_prefix_match(dst: str, routes: list[tuple[str, str]]) -> str | None:
    dst_addr = ipaddress.ip_address(dst)
    best_len = -1
    best_hop = None
    for cidr, hop in routes:
        net = ipaddress.ip_network(cidr, strict=False)
        if dst_addr in net and net.prefixlen > best_len:
            best_len = net.prefixlen
            best_hop = hop
    return best_hop

routes = [
    ("0.0.0.0/0",        "10.0.0.1"),
    ("192.168.0.0/16",   "10.0.0.2"),
    ("192.168.10.0/24",  "10.0.0.3"),
    ("192.168.10.48/29", "10.0.0.4"),
]

for dst in ["192.168.10.50", "192.168.10.1", "8.8.8.8"]:
    print(f"{dst:20s}  next hop: {longest_prefix_match(dst, routes)}")

192.168.10.50        next hop: 10.0.0.4   (/29 safety subnet wins)
192.168.10.1         next hop: 10.0.0.3   (/24 Cell 1)
8.8.8.8              next hop: 10.0.0.1   (/0 default)

If the function returns the wrong next hop for a destination, your routing table has a more specific route that is overriding the one you intended. Add or remove routes to get the correct result.

Key Takeaways

Longest prefix match always wins

A /29 route beats a /24 which beats a /0. The most specific route wins regardless of the order routes were added.

Static routing for OT

OT networks are small and stable. Static routes are predictable and have zero overhead. Use OSPF only when the network is too large to manage statically.

Every device needs a default gateway

A wrong or missing default gateway prevents communication outside the local subnet. Verify the gateway setting on every PLC and HMI.

What Comes Next

Routing moves packets between networks. The next section covers ARP and ICMP — the two protocols that make IP communication on Ethernet possible and provide the diagnostic tools every network engineer uses daily.

References

• RFC 2328 — OSPF Version 2 (IETF, 1998)
• Dijkstra, E. W. (1959). A note on two problems in connexion with graphs. Numerische Mathematik, 1(1), 269–271.
• Doyle, J., and Carroll, J. (2005). Routing TCP/IP, Volume 1 (2nd ed.). Cisco Press.