Reading the routing table: longest match, administrative distance, metric and default route

Why this matters

A router makes one decision for every packet: which next hop to send it to, or whether to drop it. That decision comes from the routing table, and show ip route prints it. A junior network engineer reads the table to explain why traffic to one branch takes the backup link, and a network technician reads it to tell a caller whether the router even knows where their server is. Reading the table correctly is the difference between fixing the right router and changing a healthy one.

The table is easy to misread. A static route looks more trustworthy than an OSPF route, so people assume it wins, when a longer OSPF prefix beats it. The numbers in brackets get swapped. A heading line is mistaken for a route. A default route is assumed to catch traffic that a more specific route actually takes. This lesson builds the reading order that avoids those mistakes: longest match first, then administrative distance, then metric. It is the basis for static routing in lesson 14 and OSPF in lesson 15.

The lesson

Finding the next hop in a routing table

The parts of an entry

Here is a small router's table:

R1# show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       E1 - OSPF external type 1, E2 - OSPF external type 2
       * - candidate default, U - per-user static route

Gateway of last resort is 192.168.1.14 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 192.168.1.14
      10.0.0.0/8 is variably subnetted, 3 subnets, 3 masks
O        10.0.0.0/8 [110/30] via 192.168.1.2, 00:10:04, GigabitEthernet0/0/0
S        10.20.0.0/16 [1/0] via 192.168.1.6
O        10.20.30.0/24 [110/40] via 192.168.1.10, 00:10:04, GigabitEthernet0/0/2
      192.168.1.0/24 is variably subnetted, 8 subnets, 2 masks
C        192.168.1.0/30 is directly connected, GigabitEthernet0/0/0
L        192.168.1.1/32 is directly connected, GigabitEthernet0/0/0
C        192.168.1.4/30 is directly connected, GigabitEthernet0/0/1
L        192.168.1.5/32 is directly connected, GigabitEthernet0/0/1
C        192.168.1.8/30 is directly connected, GigabitEthernet0/0/2
L        192.168.1.9/32 is directly connected, GigabitEthernet0/0/2
C        192.168.1.12/30 is directly connected, GigabitEthernet0/0/3
L        192.168.1.13/32 is directly connected, GigabitEthernet0/0/3

Take one line apart: O 10.20.30.0/24 [110/40] via 192.168.1.10, 00:10:04, GigabitEthernet0/0/2.

• The code, O, is the routing protocol or source: OSPF here.
• The prefix and mask, 10.20.30.0/24, is the range of destinations the route covers.
• The first bracket value, 110, is the administrative distance: how trustworthy the source is.
• The second bracket value, 40, is the metric: the protocol's own measure of the path. For OSPF it is the total cost.
• via 192.168.1.10 is the next hop.
• 00:10:04 is how long ago the route was learned.
• GigabitEthernet0/0/2 is the exit interface.

The codes to know:

• C, connected: created automatically for the subnet of each up interface.
• L, local: a /32 for the router's own address on that interface. L 192.168.1.1/32 is R1's address on Gi0/0/0, not a route to a neighbour.
• S, static: entered by an administrator with ip route. A static route that names only an exit interface shows as S 192.0.2.0/24 is directly connected, Serial0/1/0, with code S, not C.
• O, OSPF. O*E2 with 0.0.0.0/0 is an OSPF-learned external type 2 default route, injected by another router.
• *, candidate default. S* 0.0.0.0/0 is a static default route, and it sets the gateway of last resort.

A line such as 10.0.0.0/8 is variably subnetted, 3 subnets, 3 masks is a parent heading, not a route. It says the table holds three routes inside the classful 10.0.0.0/8 network, using three mask lengths. It forwards nothing itself. Here one of the three happens to be a /8 route of its own, listed underneath.

Step 1: the longest matching prefix

To find the next hop for a destination, first list every entry whose range contains it. Of those, the router uses the one with the longest prefix, the most specific. This rule comes first and always wins. Distance and metric never override it.

Worked example: 10.20.30.40 in R1's table.

1. 0.0.0.0/0 matches everything.
2. 10.0.0.0/8 covers 10.0.0.0 to 10.255.255.255. Matches.
3. 10.20.0.0/16 covers 10.20.0.0 to 10.20.255.255. Matches.
4. 10.20.30.0/24 covers 10.20.30.0 to 10.20.30.255. Matches.
5. The longest is the /24, so R1 sends the packet via 192.168.1.10.

The static /16 has the lower administrative distance, 1 against 110, but that does not matter. Distance compares routes to the same prefix; these are different prefixes.

The same table sends 10.20.99.1 via 192.168.1.6 (the /16 is its longest match), 10.5.5.5 via 192.168.1.2 (only the /8 matches), and 172.31.4.4 via 192.168.1.14 (only the default matches).

Worked example in binary: 172.20.77.5. Another router, R16, has these OSPF routes:

O     172.20.0.0/16 [110/50] via 10.1.0.2, 00:12:01, GigabitEthernet0/0/0
O     172.20.64.0/18 [110/40] via 10.1.0.6, 00:12:01, GigabitEthernet0/0/1
O     172.20.80.0/20 [110/30] via 10.1.0.10, 00:12:01, GigabitEthernet0/0/2
O     172.20.76.0/22 [110/20] via 10.1.0.14, 00:12:01, GigabitEthernet0/0/3

The first two octets, 172.20, match all four. The decision is in the third octet, 77, which is 01001101 in binary.

1. /16: no bits of the third octet are checked. Matches.
2. /18: checks the first 2 bits, 01. 172.20.64.0 is also 01, so the range is 64 to 127. Matches.
3. /20: checks the first 4 bits. 77 gives 0100 (64); the route has 0101 (80), covering 80 to 95. No match.
4. /22: checks the first 6 bits. 77 gives 010011 (76); the route is 76, covering 76 to 79. Matches.
5. Three routes match. The longest is the /22, so R16 uses via 10.1.0.14.

The quick method without binary: find each route's block size in the octet that decides (256 minus the mask value there), and list the range. A /27 in the last octet has blocks of 32, so 192.168.20.160/27 covers .160 to .191 and contains 192.168.20.170, while 192.168.20.128/27 ends at .159.

A host route, /32, is the longest possible IPv4 match. If R7 has an OSPF route for 10.9.9.0/24 via 10.0.0.2 and a static host route 10.9.9.9/32 via 10.0.0.6, packets to 10.9.9.9 go via 10.0.0.6 and everything else in the /24 via 10.0.0.2. The two routes do not clash and do not load-share; they are different prefixes.

The trap runs the other way too. If R18 has only O 10.60.4.0/24 and a default route, a packet to 10.60.5.20 does not follow OSPF. The /24 covers only 10.60.4.x, so the default route is the only match.

Step 2: administrative distance, for the same prefix

When two sources offer a route to exactly the same prefix and length, the router installs the one with the lowest administrative distance:

So a static route entered with no distance shows as [1/0]. If R9's Gi0/0/1 is in 10.6.6.0/24 and an OSPF neighbour also advertises 10.6.6.0/24, R9 installs the connected route, distance 0. The OSPF route is not preferred for having a "real" metric, because distance is compared before any metric.

Distance can be raised on a static route to make it a backup. If R4 learns 10.50.0.0/16 from OSPF via 10.0.5.2 and also has ip route 10.50.0.0 255.255.0.0 10.0.9.2 130, OSPF's 110 beats 130. Only the OSPF route is installed. The static route waits in the configuration as a floating static, and is installed only if the OSPF route disappears. Lesson 14 covers this.

Step 3: the metric, within one protocol

When one protocol offers more than one path to the same prefix, the distance is the same, so the lowest metric wins. If R10 learns 10.80.0.0/16 via 10.0.1.2 at cost 30 and via 10.0.2.2 at cost 50, it installs only the path via 10.0.1.2.

If the costs are equal, the router installs both and load-shares. IOS shows the extra path as a second via line under the same prefix:

O     10.70.0.0/16 [110/20] via 10.0.1.2, 00:03:10, GigabitEthernet0/0/0
                   [110/20] via 10.0.2.2, 00:03:10, GigabitEthernet0/0/1

Traffic to 10.70.4.4 can use both 10.0.1.2 and 10.0.2.2; CEF normally keeps each source and destination pair on one path. The order of the lines does not make the first one preferred.

Metrics from different protocols are never compared with each other. An OSPF cost and a RIP hop count measure different things, which is why distance exists.

The default route, and no route at all

The default route, 0.0.0.0/0, matches every destination, but with the shortest possible prefix. So it is used only when nothing more specific matches. It is not checked first. When a default exists, the table header says where it points:

Gateway of last resort is 203.0.113.1 to network 0.0.0.0

If R19 has O 10.1.0.0/16, S 10.2.2.0/24 and a default via 203.0.113.1, then 10.2.3.1 (outside the /24) and 10.3.0.1 (outside both) use the default. 10.1.200.5 does not: the /16 covers every 10.1.x.x address.

When no entry matches and the header reads Gateway of last resort is not set, the router drops the packet and normally sends an ICMP destination unreachable back to the source. Routers never flood unknown destinations the way switches flood unknown MAC addresses. R6 with only O 10.10.0.0/16 and a connected /30 drops a packet to 192.0.2.50, even though it has only one neighbour.

When a configured route is missing

A static route with only a next-hop address is installed only if the router can reach that next hop through another route. If R14 has ip route 10.30.0.0 255.255.0.0 10.99.99.1 but nothing in the table covers 10.99.99.1, the route stays out of show ip route. Adding a distance of 1 changes nothing, since 1 is already the default.

Commands for checking one destination

• show ip route 10.2.3.4 shows the single best entry for that address, with its source, distance and metric.
• show ip cef 10.2.3.4 shows the forwarding entry, the prefix and next hop, but without distance or metric.
• show ip route summary only counts routes by source.
• show ipv6 route prints the IPv6 table. The same three steps apply, with prefix lengths up to /128.

An IPv6 table reads the same way:

R4# show ipv6 route
IPv6 Routing Table - default - 6 entries
S   ::/0 [1/0]
     via 2001:DB8:0:3::2
O   2001:DB8:10::/48 [110/20]
     via FE80::2, GigabitEthernet0/0/1
O   2001:DB8:10:20::/64 [110/30]
     via FE80::3, GigabitEthernet0/0/2
C   2001:DB8:0:3::/64 [0/0]
     via GigabitEthernet0/0/3, directly connected
L   2001:DB8:0:3::1/128 [0/0]
     via GigabitEthernet0/0/3, receive

For 2001:db8:10:21::9, the /64 needs a fourth hextet of exactly 20, so it does not match. The /48 does, and it is longer than the default, so R4 forwards to FE80::2 out Gi0/0/1. OSPFv3 next hops are link-local addresses, which is why each is shown with its interface. The local route is a /128, the IPv6 equivalent of an IPv4 /32.

What the exam is really asking

• Longest match first, always. A /24 OSPF route beats a /16 static route for a destination in the /24.
• Distance only between equal prefixes. It decides between sources, never between a /16 and a /24.
• Lower is better for both distance and metric.
• Bracket order. [distance/metric]. [110/30] is OSPF with cost 30. [1/0] is a static route.
• Metric only within one protocol. Equal metrics load-share.
• Codes. C connected, L the router's own /32, S static, O OSPF, * candidate default, E2 external type 2.
• A parent heading is not a route.
• Check the range, not the first octets. 10.60.4.0/24 does not contain 10.60.5.20.
• Default route last. With none, the packet is dropped.
• Missing static route. The next hop cannot be resolved.