RIP (Routing Information Protocol) – Conceptual Overview
1. What Is RIP?
RIP (Routing Information Protocol) is one of the oldest interior gateway protocols (IGPs) still in use. It is a distance vector protocol — each router maintains a routing table and periodically shares that table with its directly connected neighbours, who update their own tables based on what they receive. Because routers learn about distant networks indirectly through their neighbours rather than discovering the full network topology themselves, RIP is often described as “routing by rumour.”
RIP operates at OSI Layer 3 and uses UDP port 520 (RIPv1/v2) to send routing updates. Its defining metric is hop count: the number of routers a packet must cross to reach the destination. The maximum useful hop count is 15; a value of 16 is defined as infinity (unreachable) and is used to signal that a network is down.
Related pages: RIP Configuration | OSPF Overview | OSPF Single-Area Config | EIGRP Overview | EIGRP Config | Routing Metrics | Administrative Distance | show ip route | Default Routes
2. Historical Background
RIP has gone through three versions, each addressing limitations of the previous one:
| Version | RFC | Year | Key Characteristics |
|---|---|---|---|
| RIP v1 | RFC 1058 | 1988 | Classful only; broadcasts updates to 255.255.255.255; no subnet mask in updates; no authentication; does not support VLSM or CIDR |
| RIP v2 | RFC 2453 | 1998 | Classless; multicasts updates to 224.0.0.9; includes subnet mask in every update; supports VLSM and CIDR; supports plain-text and MD5 authentication |
| RIPng | RFC 2080 | 1997 | Extension of RIPv2 for IPv6; uses UDP port 521; multicasts to FF02::9; authentication handled by IPsec |
3. Distance Vector – Routing by Rumour
Distance vector protocols like RIP share routing tables rather than topology maps. Each router only knows:
- Which networks exist (destination prefixes)
- How far away they are (hop count metric)
- Which neighbour to send traffic to (next-hop router)
Routers do not know the full network topology — they trust whatever their neighbours tell them. This is why the approach is called “routing by rumour.”
Network: 10.0.0.0/8 10.1.0.0/24 10.2.0.0/24
[R1] —————————— [R2] —————————— [R3]
R1 sees 10.2.0.0/24 as 2 hops (via R2) — it trusts R2's table
R2 sees 10.2.0.0/24 as 1 hop (directly connected)
Maximum useful diameter: 15 hops. Hop 16 = unreachable (infinity)
4. Hop Count Metric
Hop count is the only metric RIP uses to select the best path. It counts the number of routers (Layer 3 hops) a packet must cross. This simplicity is both RIP’s strength and its biggest weakness:
| Hop Count Value | Meaning | Example |
|---|---|---|
| 1 | Directly connected network | A network on R1’s own interface |
| 2 | One router away | A network behind R2, which is adjacent to R1 |
| 15 | Maximum reachable distance | Fifteen routers between source and destination |
| 16 | Infinity — network unreachable | Used by route poisoning to signal a downed route |
Problem: RIP only counts hops and ignores link speed entirely. A path through three slow 128 Kbps serial links (3 hops) is preferred over a path through four fast 10 Gbps links (4 hops), even though the four-hop path has vastly more bandwidth. This is why RIP is unsuitable for large or heterogeneous networks.
5. Periodic Updates
RIP sends its full routing table to all directly connected neighbours every 30 seconds, regardless of whether anything has changed. This is fundamentally different from link-state protocols like OSPF, which only send updates when the topology changes.
In large networks this generates significant background traffic: a router with 500 routes sends all 500 routes in every update, even if nothing has changed since the last cycle. This “chatty” behaviour is one reason RIP does not scale to large environments.
- RIPv1: sends broadcast updates to
255.255.255.255 - RIPv2: sends multicast updates to
224.0.0.9(less disruptive to non-RIP hosts)
6. RIP Timers
RIP uses four timers that collectively determine how quickly a router reacts to topology changes and how long stale routes persist:
| Timer | Default | Purpose | What Happens When It Expires |
|---|---|---|---|
| Update | 30 s | Interval between full routing-table advertisements to all neighbours | RIP sends its entire routing table to all directly connected neighbours |
| Invalid | 180 s | Time without an update before a route is marked invalid | Route metric set to 16 (unreachable); route still in table but not used for forwarding |
| Hold-down | 180 s | Time during which the router ignores updates with a worse metric for a route that was just marked invalid | Prevents acceptance of stale or looped routing information about a recently failed route |
| Flush | 240 s | Total time from last valid update until the route is completely removed from the table | Route deleted from routing table; memory reclaimed |
Convergence timeline example: a route fails at T=0. It is marked invalid at T=180 s, its metric becomes 16, and it enters hold-down. At T=240 s it is flushed entirely. The network may not have fully converged for up to 4 minutes — this is RIP’s “slow convergence” problem.
7. The Count-to-Infinity Problem
When a route fails in a RIP network, the periodic update cycle can cause routers to slowly increment the hop count toward 16 before realising the route is unreachable — a phenomenon called count-to-infinity. During this time traffic may be black-holed or loop through the network.
Before failure:
R1 — R2 — [Network X, 1 hop from R2]
Network X goes down:
R2 knows X is unreachable. But before R2 can advertise this...
R1 still has X at 2 hops in its table.
R2 receives R1's update: "X is 2 hops away via you"
R2 thinks: "If R1 can reach X in 2, I can reach it in 3" → updates to 3
R1 receives R2's update: "X is 3 hops" → updates to 4
...continues until metric reaches 16 (unreachable)
Without loop prevention, packets loop: R1 → R2 → R1 → R2...
RIP addresses count-to-infinity with three complementary mechanisms: split horizon, route poisoning, and poison reverse.
8. Loop Prevention Techniques
| Technique | How It Works | Limitation |
|---|---|---|
| Split Horizon | A router never advertises a route back out the same interface from which it learned the route. Prevents R2 from telling R1 about a route R2 learned from R1. | Does not help in hub-and-spoke topologies where multiple routers connect through one interface (e.g., Frame Relay) |
| Route Poisoning | When a route fails, the router immediately advertises it with a metric of 16 (infinity) rather than waiting for the invalid timer. This rapidly propagates the “route is dead” message through the network. | Creates a temporary spike in update traffic when many routes fail simultaneously |
| Poison Reverse | An extension of split horizon: instead of simply not advertising a route back, the router explicitly advertises it with metric 16. This confirms the poisoning and overrides any cached copy the neighbour may have. | Increases the size of RIP updates; may cause minor additional traffic |
| Hold-down Timer | After a route becomes unreachable, the router ignores any new updates claiming a worse or equal metric for that route for 180 seconds. Only a better metric or the original next-hop's update is accepted. | Adds 180 seconds to convergence time; route is unusable during hold-down even if a valid alternate path exists |
| Triggered Updates | When a route changes (especially when it fails), RIP sends an immediate update rather than waiting for the 30-second cycle. Accelerates propagation of route failures. | Can create “flash crowds” of simultaneous updates in large networks |
9. RIPv1 vs. RIPv2 – Feature Comparison
| Feature | RIP v1 | RIP v2 |
|---|---|---|
| Routing type | Classful — assumes class A/B/C boundaries | Classless — sends subnet mask with each route entry |
| Subnet mask in updates | No — mask inferred from address class | Yes — explicit mask with every prefix |
| VLSM support | No | Yes |
| CIDR support | No | Yes |
| Update destination | Broadcast: 255.255.255.255 | Multicast: 224.0.0.9 (only RIPv2 routers process) |
| Authentication | None | Plain-text or MD5 keyed hash |
| Next-hop field | Not included | Included — allows optimal next-hop advertisement |
| Auto-summarisation | Always on — cannot be disabled | On by default; can be disabled with no auto-summary |
Always use RIPv2 over RIPv1 in any network that uses VLSM or subnetting beyond classful boundaries. RIPv1 cannot carry subnet mask information and will silently summarise routes at classful boundaries, causing incorrect routing in modern networks.
10. RIP Packet Structure
Each RIP message is carried inside a UDP datagram on port 520. The high-level structure is:
| Field | Size | Values / Meaning |
|---|---|---|
| Command | 1 byte | 1 = Request (ask neighbour for its table); 2 = Response (advertisement) |
| Version | 1 byte | 1 = RIPv1; 2 = RIPv2 |
| Route Entries | Up to 25 per packet, 20 bytes each | Each entry: Address Family ID, destination IP, subnet mask (v2 only), next hop (v2 only), metric |
Because each RIP packet can carry at most 25 route entries, a router with 100 routes needs to send 4 separate packets per update cycle.
11. Administrative Distance
When a router learns about the same destination network from multiple routing protocols, it uses Administrative Distance (AD) to select which protocol’s route to install in the routing table. Lower AD = more trusted. RIP’s high AD of 120 means its routes are always superseded by OSPF (110) or EIGRP (90) if those protocols also know the route.
| Route Source | Administrative Distance |
|---|---|
| Connected interface | 0 |
| Static route | 1 |
| EIGRP (internal) | 90 |
| OSPF | 110 |
| RIP | 120 |
| EIGRP (external) | 170 |
12. RIPng – RIP for IPv6
RIPng (Next Generation, RFC 2080) is RIP adapted for IPv6 networks. It retains all the core distance vector behaviour of RIPv2 but replaces IPv4 addresses with IPv6 prefixes.
| Feature | RIPv2 (IPv4) | RIPng (IPv6) |
|---|---|---|
| Transport | UDP port 520 | UDP port 521 |
| Multicast address | 224.0.0.9 | FF02::9 (all RIPng routers) |
| Authentication | Plain-text or MD5 in packet | IPsec (external to RIPng packet) |
| Configuration scope | Enabled globally under router rip |
Enabled per-interface with ipv6 rip <name> enable |
| Max hop count | 15 | 15 |
See also: IPv6 Addressing
13. RIP vs. OSPF vs. EIGRP
| Feature | RIP | OSPF | EIGRP |
|---|---|---|---|
| Protocol type | Distance Vector | Link-State | Advanced Distance Vector (Hybrid) |
| Algorithm | Bellman-Ford | Dijkstra (SPF) | DUAL (Diffusing Update Algorithm) |
| Metric | Hop count only (max 15) | Cost (reference BW ÷ link BW) | Composite: bandwidth + delay (+ load, reliability optionally) |
| Convergence speed | Slow (up to 4 minutes) | Fast | Very fast (pre-computed backup paths) |
| Scalability | Poor — max 15 hops; full-table broadcasts | Excellent — hierarchical multi-area design | Good — bounded updates; no hop limit |
| Administrative Distance | 120 | 110 | 90 (internal) / 170 (external) |
| Update type | Full table every 30 s | Incremental (only on topology change) | Partial (only changed routes; bounded updates) |
| Standards | Open (RFC 2453) | Open (RFC 2328) | Cisco proprietary (now open: RFC 7868) |
14. When and Where to Use RIP
Appropriate scenarios:
- Small networks with fewer than 15 routers in the longest path
- Lab environments and networking courses (Packet Tracer, GNS3) where simplicity is prioritised
- Environments with legacy equipment that does not support OSPF or EIGRP
- Quick proof-of-concept setups where convergence speed is not critical
Scenarios where RIP should NOT be used:
- Networks with more than 15 routers end-to-end
- Networks with links of varying bandwidth (RIP ignores link speed)
- Environments requiring fast failover (RIP can take up to 4 minutes to converge)
- Any network where bandwidth efficiency matters (full-table broadcasts every 30 s)
15. Key Points & CCNA Exam Tips
- RIP is a distance vector IGP that uses hop count as its only metric; maximum useful hop count is 15; hop 16 = unreachable (infinity)
- RIP sends its full routing table every 30 seconds to all directly connected neighbours, regardless of whether anything has changed
- RIPv1 is classful (broadcasts, no subnet mask in updates, no VLSM, no authentication); RIPv2 is classless (multicast 224.0.0.9, includes subnet mask, supports VLSM/CIDR, MD5 authentication)
- Know all four timers: Update 30 s / Invalid 180 s / Hold-down 180 s / Flush 240 s
- Count-to-infinity: routers slowly increment a failed route’s metric toward 16 before declaring it unreachable; causes loops and slow convergence
- Split horizon = do not advertise a route back the interface it was learned from
- Route poisoning = immediately set a failed route’s metric to 16 and advertise it; faster than waiting for the invalid timer
- Poison reverse = explicitly advertise poisoned routes back (metric 16) to confirm the failure; stronger than simple split horizon
- RIP’s Administrative Distance is 120 — higher than OSPF (110) and EIGRP (90), meaning RIP routes are less preferred when those protocols also know the route
- RIPng = RIP for IPv6; UDP port 521; multicast FF02::9; configured per-interface
- RIP is not suitable for large networks due to the 15-hop limit, slow convergence, and bandwidth waste from full-table periodic broadcasts
- Use
no auto-summaryunderrouter ripin RIPv2 to prevent automatic classful summarisation at network boundaries