3.2 Static and Dynamic Routing

The previous section assigned IP addresses to devices and subnets. An IP address identifies a device, but the address does not tell the network how to reach the device. Routing solves the reachability issue: routing is the process of forwarding packets from 1 network to another based on the destination IP address. In an OT network, routing allows a SCADA server in 1 VLAN to reach a PLC in another.

Why Routing Exists

A switch forwards frames within a single network segment. The switch has no concept of networks beyond the local segment. When a PLC in 192.168.10.0/24 needs to reach a SCADA server in 192.168.20.0/24, the switch has no path to 192.168.20.0/24.

A router solves the reachability issue. The router connects multiple networks and maintains a routing table: a list of known networks and how to reach each network. When a packet arrives, the router looks up the destination IP in the table and forwards the packet toward the destination. The algorithm the router uses to find the best match is called longest prefix match.

Longest Prefix Match

When multiple routes match a destination, the router uses the most specific route. This algorithm is called longest prefix match.

A /29 route covers 8 addresses. A /0 route covers the full IPv4 address space. The /29 is more specific. The /29 was configured for a reason. Using the /29 respects the network designer’s intent. Every device on the network also needs to know where to send packets outside the local subnet — the default gateway serves this purpose.

Default Gateway

Every end device needs a default gateway: the IP address of the router on the local subnet. When a device sends a packet to an address outside the local subnet, the device sends the packet to the default gateway.

If the default gateway is incorrect or unreachable, the device communicates only within the local subnet. In OT networks, the routing table is configured manually in most cases.

Static Routing

Static routes are manually configured entries in the routing table. Static routes do not change unless an administrator modifies the entries.

Static routing is the standard in OT networks. Industrial networks are small, stable, and change infrequently. The predictability of static routing is a feature, not a limitation.

Hirschmann HiOS:

Routing → Routing Table → Add
Destination: 10.0.0.0  Mask: 255.0.0.0  Next Hop: 192.168.10.1

For larger networks where static routing becomes unmanageable, OSPF provides automatic route discovery.

OSPF: Dynamic Routing for Larger Networks

OSPF (Open Shortest Path First) is a link-state routing protocol. Every OSPF router builds a complete map of the network (the LSDB) and calculates shortest paths using Dijkstra’s algorithm. Use OSPF when the network is too large to manage with static routes, or when automatic failover between redundant paths is required.

Key terms:

• LSDB (Link State Database) — a complete map of the network topology. Every OSPF router has an identical copy.
• OSPF cost — the metric used by SPF. Default = 100,000,000 / interface_bandwidth_bps. With the default reference bandwidth, links faster than 100 Mbps receive cost 1. Set the reference bandwidth to 10,000 Mbps on modern networks.

Whether using static or dynamic routing, verify that the routing table produces the expected behavior.

Verifying Routing Behavior

When debugging a routing issue, determine which route a router uses for a given destination. The following function implements the same longest prefix match algorithm a router uses. Run the function against the routing table to verify the expected behavior before making changes:

import ipaddress

def longest_prefix_match(dst: str, routes: list[tuple[str, str]]) -> str | None:
    dst_addr = ipaddress.ip_address(dst)
    best_len = -1
    best_hop = None
    for cidr, hop in routes:
        net = ipaddress.ip_network(cidr, strict=False)
        if dst_addr in net and net.prefixlen > best_len:
            best_len = net.prefixlen
            best_hop = hop
    return best_hop

routes = [
    ("0.0.0.0/0",        "10.0.0.1"),
    ("192.168.0.0/16",   "10.0.0.2"),
    ("192.168.10.0/24",  "10.0.0.3"),
    ("192.168.10.48/29", "10.0.0.4"),
]

for dst in ["192.168.10.50", "192.168.10.1", "8.8.8.8"]:
    print(f"{dst:20s}  next hop: {longest_prefix_match(dst, routes)}")

192.168.10.50        next hop: 10.0.0.4   (/29 safety subnet wins)
192.168.10.1         next hop: 10.0.0.3   (/24 Cell 1)
8.8.8.8              next hop: 10.0.0.1   (/0 default)

If the function returns the incorrect next hop for a destination, the routing table has a more specific route overriding the intended route. Add or remove routes to get the correct result.

Key Takeaways

Longest prefix match selects the route

A /29 route beats a /24 which beats a /0. The most specific route wins regardless of the order routes were added.

Static routing for OT

OT networks are small and stable. Static routes are predictable and have zero overhead. Use OSPF only when the network is too large to manage statically.

Every device needs a default gateway

An incorrect or missing default gateway blocks communication outside the local subnet. Verify the gateway setting on every PLC and HMI.

What Comes Next

Routing moves packets between networks. The next section covers ARP and ICMP — the 2 protocols that make IP communication on Ethernet possible and provide the diagnostic tools network engineers use daily.

References

• RFC 2328 — OSPF Version 2 (IETF, 1998)
• Dijkstra, E. W. (1959). A note on two problems in connexion with graphs. Numerische Mathematik, 1(1), 269–271.
• Doyle, J., and Carroll, J. (2005). Routing TCP/IP, Volume 1 (2nd ed.). Cisco Press.