What a routing table is
A routing table gathers the information a router uses to decide which destinations it knows and how those destinations can be reached. Entries are expressed as prefixes rather than a list of every possible host. A prefix represents a set of addresses that share the same leading bits.
IPv4 tables may contain entries such as 10.10.0.0/16; IPv6 tables may contain 2001:db8:10::/48. Prefix length matters because it defines how specific the route is and therefore affects forwarding decisions.
Route fields you should know how to read
The exact display changes across operating systems, but a route normally includes a destination prefix, an origin or protocol, a next hop, an outgoing interface, and selection information such as a metric or preference. Some platforms also show route age, labels, administrative values, or protocol-specific attributes.
| Field | Question it answers |
|---|---|
| Prefix | Which destinations does this entry cover? |
| Next hop | Which neighboring router receives the packet? |
| Interface | Which local link does the packet leave through? |
| Origin | How was the route learned? |
| Metric / preference | How is this candidate compared with alternatives? |
RIB and FIB: route selection versus forwarding
The Routing Information Base (RIB) represents routes considered by the control plane. The Forwarding Information Base (FIB) is optimized for fast packet forwarding and may be programmed into specialized hardware such as switching ASICs.
Not every platform exposes these terms in exactly the same way, but the conceptual distinction prevents a common mistake: a routing protocol may know a route that is not actually the active forwarding route.
Connected, static, and dynamic routes
Connected routes appear because Layer 3 interfaces are up with configured prefixes. Static routes are entered explicitly. Dynamic routes are learned through protocols such as OSPF or BGP. A router can know several candidates for the same prefix and must decide which candidate becomes active.
On Cisco platforms, administrative distance is commonly used to compare route sources when they offer the same prefix; protocol metrics then compare paths learned by the same protocol. Keep that process separate from Longest Prefix Match, which compares installed prefixes during the destination lookup.
Longest Prefix Match step by step
Suppose the table contains 10.0.0.0/8, 10.20.0.0/16, and 10.20.30.0/24. A packet for 10.20.30.77 uses /24 because it is the longest matching prefix. A packet for 10.20.99.10 cannot use the /24, so /16 wins.
The 0.0.0.0/0 and ::/0 entries
A default route covers the complete address space of its family but is the least specific possible route. It therefore acts as a last resort. A branch office with one upstream path might point its default route at the provider router or perimeter firewall.
If a more-specific route exists, that route wins. This allows a compact table to coexist with precise exceptions.
Recursive next-hop resolution
A route can name only a next-hop IP address. The router still needs to determine how to reach that next hop, so it may perform another lookup until it resolves an outgoing interface and adjacency. This is called recursive resolution.
If the next hop becomes unreachable, a route can become unusable even if the configured statement still exists. That is why static-route troubleshooting must validate both the destination prefix and the reachability of the next-hop neighbor.
Multiple equal-cost routes
When several eligible next hops exist for the same prefix with equal cost, a router can install multiple entries and use ECMP. Production implementations commonly distribute flows by hash rather than alternating every individual packet.
ECMP can improve capacity and resilience, but it is not automatically harmless. Asymmetric paths can interact with stateful firewalls, NAT, or applications that expect return traffic to cross the same device.
A practical reading example
Imagine a route to 172.16.40.0/24 via 192.0.2.2, learned through OSPF, plus a default route via 198.51.100.1. A destination such as 172.16.40.20 uses the /24 because it is more specific. A destination such as 203.0.113.50 uses the default only if no longer prefix matches it.
The next questions are whether 192.0.2.2 itself is reachable and whether the remote network has a valid return route. Reading the routing table is the start of the diagnosis, not the end.
IPv6 routing tables
IPv6 uses the same longest-prefix concept with 128-bit addresses. A router may maintain separate IPv4 and IPv6 forwarding state. You can therefore have a correct IPv4 route and no equivalent IPv6 route, or the reverse.
Review IPv6 addressing if prefixes such as /48, /56, /64, and /128 are not yet intuitive. Prefix literacy is just as important in IPv6 as understanding /16, /24, and /32 is in IPv4.
Common routing-table mistakes
- Assuming a known route is automatically the route being used.
- Comparing metrics before checking prefix length.
- Forgetting recursive next-hop resolution.
- Checking only the forward path and ignoring the return path.
- Treating a default route as proof of connectivity.
- Ignoring VRFs, policy tables, or separate routing instances.
Diagnosis checklist
Start with the exact destination. Identify every prefix that contains it and find the longest match. Read the next hop and interface. Confirm that the interface is operational and that the next hop is reachable. If the route came from a protocol, verify that the protocol still advertises it and that no other candidate replaced it.
Then use ping and traceroute carefully. A missing reply can be caused by filtering, NAT, or a broken return path even when the outbound route is correct.
What to study next
Practice with static routes first because they let you control every decision manually. Then move to OSPF to see how a protocol builds routes dynamically. Finally, study route summarization to understand how hierarchical addressing can reduce the number of prefixes carried through a network.