Every time you stream a movie, load a website, or push a git commit, your packets probably traverse a network where multiple equal-cost paths exist between source and destination. How does a router decide which path each packet takes? RFC 2992 documents the algorithm — hash-threshold ECMP — that quietly powers load distribution across the modern internet's backbone and inside every hyperscale datacenter.

The problem. When a routing protocol (OSPF, IS-IS, BGP) computes shortest paths and finds N next-hops with identical cost, the router has a choice to make for every packet. Naïve approaches all have issues:

• Round-robin per packet: distributes load evenly but reorders TCP segments, causing fast-retransmit cascades and tanking throughput.
• Per-destination: keeps flows intact but distributes poorly when traffic is dominated by a few heavy destinations.
• Modulo-N hashing (hash(flow) mod N): keeps flows on one path, but when N changes — a link flaps, a peer withdraws — every flow remaps to a new next-hop. Catastrophic for stateful middleboxes and NAT tables.

The hash-threshold idea. Hopps' algorithm hashes the flow's five-tuple into a large key space (say, 2^16), then divides that space into N contiguous regions, one per next-hop. A flow is assigned to whichever region contains its hash. When the number of next-hops changes from N to N+1, the regions are re-partitioned — but each flow either stays in its current region or moves to one adjacent region. Roughly 1/(N+1) of flows shift, instead of all of them. This is the same insight behind consistent hashing, applied to packet forwarding.

Why this matters today. ECMP is everywhere:

• Datacenter fabrics: Clos / leaf-spine topologies depend on ECMP to spread east-west traffic across dozens of equal-cost uplinks. Without it, leaf-spine doesn't work.
• BGP multipath: ISPs balance customer traffic across parallel transit links using the same hash-threshold approach.
• LAG / 802.3ad bonding: Linux's bonding driver and switch link-aggregation use ECMP-style hashing to pick a member link.
• Anycast load balancing: When you hit 8.8.8.8 or a CDN POP, BGP delivers you to one of many sites; ECMP inside the destination AS picks the actual server.

The dark corners. RFC 2992 also analyzes what goes wrong. Hash polarization is the big one: if every router in a path uses the same hash function on the same fields, flows that collided on router A also collide on router B, causing some paths to saturate while others sit idle. Modern silicon mitigates this by seeding each router's hash differently, or by including the TTL or a per-device salt. Another gotcha: flowlet approaches (briefly switching paths during a TCP idle gap) extend Hopps' work, used in Microsoft's CONGA and in Cisco's dynamic load balancing.

The backstory. Christian Hopps wrote this as an Informational RFC while at NextHop Technologies, a small routing-software shop. It's only about 8 pages — really a worked example with probability math, not a protocol spec. But it became the reference cited by every router vendor, every datacenter paper, and every IETF draft that touches multipath. A rare case of a short, mathy RFC quietly setting the operational standard for an entire industry.

Next time you run ip route show and see multiple nexthop lines, you're looking at hash-threshold ECMP in action.