Routing Tables

Every packet that crosses your network asks the same question at every router: "Where do I go next?" The routing table provides the answer.

A routing table is a decision tree. When a packet arrives, the router looks up the destination IP address and finds the next step in the journey—which interface to use, which router to forward to, or whether the destination is right here. This lookup happens for every packet, millions of times per second. The routing table is where forwarding decisions live.

What a Routing Table Contains

Each entry in a routing table (called a route) contains:

Destination Network: The network this route applies to (e.g., 192.168.1.0/24)

Next Hop: The IP address of the next router, or an indication to deliver locally

Interface: The physical or logical port to send packets out

Metric: The "cost" of this route—used to choose between multiple paths to the same destination

Administrative Distance: Priority when routes from different sources conflict

Route Source: How the router learned this route (connected, static, OSPF, BGP, etc.)

Where Routes Come From

Routes enter the routing table from four sources:

Directly Connected: Networks attached to the router's interfaces appear automatically. If interface GigabitEthernet0/0 has IP 192.168.1.1/24, the router knows 192.168.1.0/24 is directly reachable.

Static Routes: Manually configured by administrators. You tell the router: "To reach 10.0.0.0/8, forward to 192.168.1.254."

Dynamic Routing Protocols: OSPF, BGP, EIGRP, and RIP automatically discover and share routes. Routers learn from each other and build their tables collaboratively.

Default Route: Written as 0.0.0.0/0, this matches everything. When no specific route exists, the default route catches the packet. It's the "when in doubt, go here" entry.

Reading a Routing Table

Here's a real routing table from a Cisco router:

Gateway of last resort is 203.0.113.1 to network 0.0.0.0

C    192.168.1.0/24 is directly connected, GigabitEthernet0/0
L    192.168.1.1/32 is directly connected, GigabitEthernet0/0
S    192.168.2.0/24 [1/0] via 10.0.1.2
O    192.168.3.0/24 [110/20] via 10.0.1.3, 00:15:30, GigabitEthernet0/1
B    8.8.8.0/24 [20/0] via 203.0.113.1, 1d02h
S*   0.0.0.0/0 [1/0] via 203.0.113.1

The single letter at the start tells you where the route came from:

• C: Directly connected
• L: Local (the router's own IP address)
• S: Static route
• O: OSPF
• B: BGP
• S*: Static default route

The numbers in brackets like [110/20] are administrative distance and metric. The first number (110) indicates trust level—lower is more trusted. The second number (20) is the cost within that routing protocol.

Longest Prefix Match: Specificity Wins

When multiple routes could match a destination, the most specific route wins. This is called longest prefix match.

If the routing table contains:

192.168.0.0/16 via 10.0.1.1
192.168.1.0/24 via 10.0.2.1
192.168.1.128/25 via 10.0.3.1

A packet destined for 192.168.1.200 matches all three. But /25 is the longest prefix (most specific), so the packet goes to 10.0.3.1.

This rule is absolute. A /32 host route beats a /24 network route beats a /16 summary route, regardless of metrics or administrative distance. Specificity trumps everything.

Administrative Distance: Who Do You Trust?

When different routing sources provide routes to the same destination, administrative distance decides which one to believe. Lower means more trusted:

If OSPF and RIP both advertise routes to 192.168.5.0/24, the OSPF route wins—110 beats 120.

The logic reflects reliability. Directly connected routes are inherently trustworthy (you can see the wire). Static routes are explicitly configured by humans. Dynamic protocols vary in sophistication. iBGP gets low priority because it's typically backup to interior protocols.

Metrics: Choosing the Best Path

When a single routing protocol provides multiple paths to the same destination, metric determines which path is best. Different protocols measure cost differently:

RIP: Hop count. Fewer routers to traverse = better.

OSPF: Cost based on bandwidth. A 10 Gbps link costs less than a 100 Mbps link.

EIGRP: Composite metric considering bandwidth, delay, and optionally reliability and load.

BGP: Multiple attributes evaluated in order—AS path length, local preference, origin type, MED, and more.

Lower metrics generally mean better paths, though BGP's attribute evaluation is more nuanced.

Default Routes: The Safety Net

A default route (0.0.0.0/0) catches packets when no specific route matches. It's essential at network edges:

Stub networks with one exit point use a default route instead of maintaining full routing tables. Why learn thousands of routes when everything leaves through the same door?

Internet gateways use default routes for Internet-bound traffic. Your home router has one route: send everything to your ISP.

Fallback paths provide connectivity when specific routes fail.

But default routes can mask problems. Traffic goes "somewhere" even when the right route is missing. A packet might reach the Internet when it should have stayed internal—and you won't notice until something breaks.

Equal-Cost Multipath: Using All Available Paths

When multiple routes to a destination have identical metrics, routers can use them all simultaneously. This is equal-cost multipath (ECMP).

O    192.168.5.0/24 [110/20] via 10.0.1.2, GigabitEthernet0/1
                     [110/20] via 10.0.1.3, GigabitEthernet0/2

Both paths have cost 20. The router distributes traffic across them—typically by hashing source and destination IPs so that flows stay on consistent paths while aggregate traffic balances.

ECMP provides more bandwidth (two paths carry twice the traffic), redundancy (one path can fail), and better utilization (neither link sits idle).

Route Summarization: Making Tables Smaller

Four routes:

192.168.0.0/24
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24

Become one:

192.168.0.0/22

This is route summarization. Fewer routes mean smaller tables, faster lookups, and less routing protocol chatter.

The tradeoff: summarization can cause suboptimal routing. If one of those /24 networks is actually closer via a different path, the summary route hides that detail. Longest prefix match means more-specific routes always win, so careful placement of summaries matters.

Floating Static Routes: Backup Paths

A static route with artificially high administrative distance serves as a backup:

S    192.168.5.0/24 [200/0] via 10.0.2.1

With AD 200, this route won't install while an OSPF route (AD 110) exists. But if OSPF fails—the dynamic route disappears—the static route "floats" up and becomes active.

This pattern provides automatic failover without complex configuration.

Routing Table Size

Table size varies enormously:

Home routers: Dozens of routes (local networks, default route)

Enterprise edge: Hundreds to thousands (internal networks, VPNs, customer connections)

Internet core: The full Internet routing table exceeds 950,000 routes

Larger tables require more memory and faster lookups. Modern routers use specialized data structures (Patricia tries, TCAMs) to search even massive tables in constant time.

Troubleshooting with Routing Tables

When packets don't reach their destination, the routing table tells you why:

No route exists: The router doesn't know how to reach the destination. Add a route or fix the routing protocol.

Wrong route exists: Traffic takes an unexpected path. Check metrics and administrative distance.

Route flapping: Routes appear and disappear rapidly. Something is unstable—a link, a routing peer, or protocol configuration.

Recursive lookup fails: The next hop isn't reachable. The route exists but can't be used.

Every platform has commands to inspect the routing table: show ip route (Cisco), route print (Windows), ip route show (Linux), netstat -rn (macOS/BSD). Learn yours.