CCNA Routing Table: Next Hop, Longest Match and Administrative Distance

Each IPv4 entry in show ip route tells you, from left to right, where the route came from (the source code), which destinations it covers (prefix/mask), how trusted and how good it is ([administrative distance/metric]), where to send matching packets (the next hop after via), how long ago it was learned and which interface it leaves through.

O        172.31.40.0/24 [110/65] via 10.1.1.2, 01:02:17, GigabitEthernet0/2
^code    ^prefix/mask    ^AD ^metric ^next hop ^age     ^exit interface

The order inside the brackets never changes: the first number is the administrative distance and the second is the metric. The metric's unit depends on the protocol: OSPF cost, EIGRP composite metric, RIP hop count. Connected and local routes show no brackets; static routes normally show [1/0].

Heading lines are not routes

IOS groups entries under their classful network with a heading such as 10.0.0.0/8 is variably subnetted, 6 subnets, 3 masks. It means six entries below it fall inside 10.0.0.0/8 and they use three different prefix lengths. When every subnet shares one mask, the heading says is subnetted instead and shows that shared mask rather than the classful one: 172.16.0.0/24 is subnetted, 2 subnets means two /24 subnets of 172.16.0.0, not a route to 172.16.0.0/24. A heading has no code, no next hop and no brackets: it matches no traffic, so a destination that is inside 10.0.0.0/8 but outside every listed subnet is not covered by it.

Looking up one destination

When a specific route matches, show ip route <address> shows the entry the router would use for that address, in long form (if only the default route would match, IOS answers % Network not in table):

R1# show ip route 172.31.40.9
Routing entry for 172.31.40.0/24
  Known via "ospf 10", distance 110, metric 65, type intra area
  Last update from 10.1.1.2 on GigabitEthernet0/2, 01:02:17 ago
  Routing Descriptor Blocks:
  * 10.1.1.2, from 3.3.3.3, 01:02:17 ago, via GigabitEthernet0/2
      Route metric is 65, traffic share count is 1

"Known via" names the protocol and process ID; distance and metric match the bracket values. Each routing descriptor block is one path: the first address is the next hop and via names the exit interface. The from 3.3.3.3 value is the OSPF router ID of the router that originated the information, not an address to forward to. One descriptor block means one path; several blocks mean equal-cost paths sharing the traffic.

The code at the start of each line names the routing source, and the legend at the top of show ip route lists them all. The ones CCNA expects you to read on sight:

EIGRP routes are coded D (for DUAL, its algorithm), not E, so don't misread them. In a normal table, S and S* entries come from route commands typed on this router (one exception: an interface configured with ip address dhcp can install an S* default with distance 254 from the DHCP-supplied gateway); C and L are generated from interface addresses, and every other code was learned from a neighbour. An external code (D EX, O E2) means some router redistributed the route, but it still reached this router dynamically. Configuring OSPF itself (areas, adjacencies) belongs to the OSPF lesson; here you only need to read what the codes say.

Connected (C) and local (L) routes are created automatically when an interface has an IPv4 address and is up/up. Configuring ip address 192.168.7.65 255.255.255.192 on an up interface adds two entries:

C        192.168.7.64/26 is directly connected, GigabitEthernet0/3
L        192.168.7.65/32 is directly connected, GigabitEthernet0/3

• The C route is the attached subnet, built from the address and its mask. The router delivers packets for it directly to the destination host (it ARPs for the host itself).
• The L route is a /32 host route for the router's own address. It lets the router recognise packets addressed to itself (pings, SSH, routing protocol traffic). It describes the router itself and is created automatically from the interface address.

Both disappear when the interface goes down and return when it comes back up. Connected routes have an administrative distance of 0, the most trusted source there is, so a static route for exactly the same subnet (distance 1) cannot replace a connected route while the interface is up. Sending a directly attached subnet somewhere else needs a design change, not a static route.

A router forwards each packet using the longest prefix that contains the destination address. It compares the destination with every route; of the routes that match, the one with the most mask bits wins, whatever its source, distance or metric. Different prefix lengths are different routes, and they all stay in the table side by side.

Working out whether a prefix contains an address

For masks that do not end on an octet boundary, find the block size in the octet where the mask ends and list the range:

Worked example: a router has 172.20.0.0/16, 172.20.24.0/21, 172.20.28.0/22 and 172.20.30.0/23. A packet for 172.20.29.4 has third octet 29: it is in the /16 (anything 172.20.x.x), in the /21 (24 to 31) and in the /22 (28 to 31), but not in the /23 (30 to 31). The longest match is the /22, so its next hop is used. A packet for 172.20.33.1 matches only the /16.

Host routes and the default route are the two extremes

A /32 (IPv4) or /128 (IPv6) host route matches exactly one address, so for that address it beats every other route; a neighbouring address does not match it at all and falls to the next longest prefix. The default route 0.0.0.0/0 checks zero bits, so it matches every destination and loses to every other match. The prefix length, not the address, decides how much a route covers: only a /0 length makes a catch-all.

Administrative distance (AD) is how much a router trusts a routing source, and it decides only between routes for the identical prefix and mask offered by different sources: the lowest AD is installed. It is never used to compare a /16 with a /24: a static /16 with AD 1 still loses to an OSPF /24 with AD 110 for any destination inside the /24.

Metrics from different protocols are never compared: an OSPF cost of 20 and an EIGRP metric of 3072 are in different units, so when both protocols offer the same prefix, EIGRP's internal route wins on 90 versus 110. Watch the internal/external split: an external EIGRP route has AD 170, so OSPF (110) beats it. When you judge someone's explanation (a colleague's or an AI assistant's), check both the conclusion and the reason: a right answer reached by comparing metrics across protocols is still wrong reasoning.

Changing the distance of a static route

The optional number at the end of an ip route command sets that route's distance. A static route with a distance higher than the protocol's (for example 250 against OSPF's 110) loses while the dynamic route exists and is installed only if it disappears: a floating static. A static route with the default distance of 1 replaces the dynamic route for that exact prefix. Configuring and troubleshooting floating statics is covered in the static routing lesson; for reading a table, remember that the losing route is simply absent from show ip route.

The metric chooses between paths that one routing protocol has to the same prefix; lower is better. Because both paths share the protocol, their AD is equal and cannot separate them. OSPF installs the path with the lowest total cost (the sum of the interface costs along the path, not the local link alone); EIGRP installs the lowest composite metric; RIP the fewest hops. A worse path is not installed beside the best one: it stays in the protocol's own database (the OSPF LSDB, the EIGRP topology table) and is used only if the best path fails.

Equal-cost multipath

When several paths tie on the best metric, the protocol installs them all and the router shares the traffic. The table shows one prefix with several next-hop lines carrying identical values:

O        172.24.0.0/16 [110/12] via 10.2.1.2, 00:11:05, GigabitEthernet0/1
                       [110/12] via 10.2.2.2, 00:11:05, GigabitEthernet0/2

• Neither path is a standby; with CEF the router spreads traffic per destination flow by default.
• Each routing process caps how many equal paths it installs. On Cisco IOS the OSPF default for maximum-paths is 4: six tied OSPF paths produce four next hops.
• Only an equal total metric creates multipath. In OSPF that metric is the cost summed over every link on the path, so the paths must tie on that sum.
• EIGRP at default settings (variance 1) installs only equal-best paths; unequal-cost load sharing needs a non-default variance.

Multipath happens after the source has been chosen. If a static route for the same prefix (AD 1) is added while OSPF has two equal paths (AD 110), the static route alone is installed and carries all the traffic; the OSPF paths return only if the static route is removed.

The order is fixed: longest prefix first for each packet; then, for routes competing for the identical prefix, lowest administrative distance picks the source; then, within that source, lowest metric picks the path; and paths that tie on the metric are installed together.

Steps 2 to 4 decide which entries exist; step 1 decides which existing entry a packet uses. That is why a RIP /27 (AD 120) carries traffic for addresses inside it even when a static /16 and an EIGRP /24 also contain them, and why an OSPF /24 with a high cost beats an OSPF /16 that has a lower cost and two equal-cost paths, for the /24's own addresses. A practical consequence: to steer one subnet somewhere else without touching the routing protocol, you need a route for that identical prefix (or a longer one) with a lower distance than the protocol's; a shorter prefix, however trusted, never wins.

The default route (0.0.0.0/0 in IPv4, ::/0 in IPv6) is the route used for every destination that no more specific route contains, and the gateway of last resort line at the top of show ip route names its next hop.

Gateway of last resort is 198.51.100.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 198.51.100.1

• The * marks a candidate default. A default can be static (S*) or learned: O*E2 0.0.0.0/0 [110/1] is a default that another OSPF router originated as an external type 2 route.
• When two sources offer 0.0.0.0/0, AD decides as for any other prefix: an OSPF default (110) beats a static default configured with distance 250, which floats until the OSPF default disappears.
• The default is the last choice, not a preferred one: a destination that falls inside any listed route uses that route, and only addresses outside every route (including addresses that fall in a heading's classful network but in no listed subnet) use the default.

No match and no default: the packet is dropped

Gateway of last resort is not set means there is no default route. A packet whose destination matches no entry is then discarded, and the router can send an ICMP destination-unreachable message back to the source. Routing is exact: with no matching entry, discarding is the only outcome. Contrast this with a switch, which handles an unknown MAC address by flooding the frame.

A route tells the router either a next-hop address, an exit interface, or both, and the form decides how much more work the router does before it can send the frame:

"Directly connected" on an S line does not make it a connected route: the S code says static, and the phrase only means no next-hop address was configured.

Recursive lookup

When a route's next hop is not on a connected subnet, the router looks up the next-hop address itself, using longest match again. Example: S 192.0.2.0/24 via 10.9.34.4, where 10.9.34.4 falls in O 10.9.34.0/30 via 10.9.12.2, GigabitEthernet0/1. A packet for 192.0.2.50 is sent out Gi0/1 and the router ARPs for 10.9.12.2, the directly connected neighbour. The IP destination inside the packet stays 192.0.2.50 throughout; only the frame's destination MAC changes at each hop.

A static route with only a next-hop address is installed only while that next hop resolves. If the route covering the next hop is withdrawn, the router re-resolves it through whatever else covers it (a shorter summary, for example), and the static route stays up via the new path. If nothing covers the next hop any more, the static route is withdrawn from the routing table while it stays in the running configuration, and it reappears by itself when the next hop resolves again.

show ipv6 route uses the same codes and the same [AD/metric] brackets as IPv4, but prints each route on two lines and shows a few entries IPv4 does not:

S   ::/0 [1/0]
     via 2001:DB8:FF::1
C   2001:DB8:A:1::/64 [0/0]
     via GigabitEthernet0/0, directly connected
L   2001:DB8:A:1::1/128 [0/0]
     via GigabitEthernet0/0, receive
O   2001:DB8:B:20::/64 [110/3]
     via FE80::2, GigabitEthernet0/1
L   FF00::/8 [0/0]
     via Null0, receive

• ::/0 is the IPv6 default route, the equivalent of 0.0.0.0/0.
• C is the attached prefix; L ... /128, receive is the router's own address, and a packet to exactly that address is delivered to the router itself, not forwarded. It is the IPv6 equivalent of the L /32.
• FF00::/8 via Null0 is the multicast range, installed automatically. It is not a default route.
• OSPFv3 next hops are link-local addresses (FE80::...). Because the same link-local address can exist on every link, the entry always pairs it with the exit interface.

Longest match with hex prefixes

Each hextet is 16 bits, four hex digits. Expand the leading zeros before comparing. A /48 compares the first three hextets; a /64 the first four; a /56 the first three hextets plus the first two hex digits of the fourth. So 2001:DB8:C:200::/56 covers fourth hextets 0200 to 02FF: 2001:DB8:C:2B0::9 is inside it, while 2001:DB8:C:20::9 (fourth hextet 0020) is not. A /128 matches a single address; an address that differs in its last bits falls through to the /64.