Interpret the components of routing table

The routing table is the router’s map of the world. The command that displays it is show ip route for IPv4 and show ipv6 route for IPv6. The exam expects you to read this output line by line and explain every field, so we will do exactly that with a realistic sample. Read the sample now, then come back to it as each component is explained.

R1# show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is 203.0.113.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 203.0.113.1
      10.0.0.0/8 is variably subnetted, 6 subnets, 3 masks
C        10.1.1.0/24 is directly connected, GigabitEthernet0/0
L        10.1.1.1/32 is directly connected, GigabitEthernet0/0
O        10.1.2.0/24 [110/2] via 10.1.1.2, 00:12:45, GigabitEthernet0/0
O IA     10.2.0.0/16 [110/3] via 10.1.1.2, 00:12:45, GigabitEthernet0/0
D        10.3.3.0/24 [90/3072] via 10.1.1.3, 01:02:10, GigabitEthernet0/0
S        10.9.9.0/24 [1/0] via 10.1.1.2
      172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C        172.16.5.0/30 is directly connected, GigabitEthernet0/1
L        172.16.5.1/32 is directly connected, GigabitEthernet0/1
R        192.168.7.0/24 [120/1] via 172.16.5.2, 00:00:12, GigabitEthernet0/1
B        192.168.100.0/24 [20/0] via 203.0.113.1, 2d03h
i L1     192.168.200.0/24 [115/20] via 172.16.5.2, 00:05:33, GigabitEthernet0/1
      203.0.113.0/24 is variably subnetted, 2 subnets, 2 masks
C        203.0.113.0/30 is directly connected, GigabitEthernet0/2
L        203.0.113.2/32 is directly connected, GigabitEthernet0/2

Let us decode a single typical line so the pattern is clear:

O        10.1.2.0/24 [110/2] via 10.1.1.2, 00:12:45, GigabitEthernet0/0

Every dynamically learned route follows this exact template. Connected and local routes look slightly different (“is directly connected”) because there is no next-hop router: the network is right there on the interface.

The indented header lines such as 10.0.0.0/8 is variably subnetted, 6 subnets, 3 masks are not routes. They are grouping lines: IOS groups all subnets that belong to the same old-style classful network (here the class A network 10.0.0.0) and tells you how many subnets and how many different mask lengths appear under that parent. “Variably subnetted” simply means more than one mask length is in use (VLSM). If every subnet used the same mask, the line would read 10.0.0.0/24 is subnetted, 4 subnets.

3.1.a Routing protocol code

The single letter (or letter pair) at the far left of each route tells you how the router learned the route. The full legend is printed at the top of show ip route, but you must memorize the common ones because exam questions show the routes without the legend.

Looking back at the sample: C and L pairs appear for each of R1’s three interfaces, S marks the manually configured route to 10.9.9.0/24, S* marks the default route, O and O IA are OSPF, D is EIGRP, R is RIP, B is BGP, and i L1 is IS-IS. You will rarely see all of these on one real router; the sample is deliberately packed so you can practice recognizing each code.

Connected versus local routes

Whenever you configure an IP address on an interface and that interface comes up, IOS installs two routes automatically:

• The connected route (C) covers the whole subnet on that interface, for example C 10.1.1.0/24 is directly connected, GigabitEthernet0/0. It tells the router “any destination inside 10.1.1.0/24 can be reached by sending the packet straight out Gi0/0; no next-hop router is needed.”
• The local route (L) covers only the router’s own address on that interface with a /32 mask, for example L 10.1.1.1/32 is directly connected, GigabitEthernet0/0. It tells the router “packets addressed to 10.1.1.1 are for me; process them locally rather than forwarding them.”

Because a /32 is longer (more specific) than a /24, the local route always wins the longest-prefix-match lookup for the router’s own address. That is the whole point of it: the router should never try to forward a packet that is addressed to itself. For IPv6 the same pair exists with C for the /64 (or whatever prefix) and L for the /128.

3.1.b Prefix

The prefix is the network address portion of the route: 10.1.2.0 in 10.1.2.0/24. It identifies which block of addresses this route describes. A prefix is meaningless without its mask, because 10.1.2.0 could be the start of a /24 (256 addresses) or a /16 (65,536 addresses) or a /30 (4 addresses).

When a packet arrives, the router compares the packet’s destination IP address against each prefix in the table, but only the bits covered by that route’s mask are compared. A destination of 10.1.2.77 “matches” the prefix 10.1.2.0/24 because the first 24 bits (10.1.2) are identical; the remaining 8 bits are the host portion and are ignored for matching purposes.

The special prefix 0.0.0.0/0 has a mask of zero bits, so zero bits are compared and it matches every possible destination. That is what makes it the default route (see 3.1.g). The other extreme, a /32 prefix, matches exactly one address and is called a host route (see 3.3.c).

3.1.c Network mask

The network mask (or prefix length) tells the router how many leading bits of the prefix are significant. In show ip route it always appears in CIDR notation as /24, /30, /32, and so on, even though you type masks in dotted-decimal form (255.255.255.0) when you configure a static route.

The mask determines:

• How many addresses the route covers. /24 covers 256 addresses, /25 covers 128, /30 covers 4, /32 covers 1.
• How specific the route is. A longer mask (bigger number) means a more specific route. This matters enormously for forwarding: the router always prefers the most specific matching route (objective 3.2.a).

You must be fluent at converting between the two notations, because the exam will show /26 in one place and 255.255.255.192 in another and expect you to know they are the same.

3.1.d Next hop

The next hop is the IP address of the neighboring router that should receive the packet next. In O 10.1.2.0/24 [110/2] via 10.1.1.2, ... the next hop is 10.1.1.2. The router does not need to know the entire path to the destination; it only needs to know the very next router to hand the packet to. That router will then do its own lookup, and so on, hop by hop, until the packet reaches a router that has the destination as a connected network.

After the next hop, IOS prints the exit interface: the local interface the router will use to reach that next hop. In the sample, 10.1.1.2 is reachable out GigabitEthernet0/0. The router learns which interface to use by looking up the next hop address itself in the routing table (a process called recursive lookup): it finds C 10.1.1.0/24 ... GigabitEthernet0/0, so it knows Gi0/0 is the way to reach 10.1.1.2.

A few observations about next hops in the sample:

• S 10.9.9.0/24 [1/0] via 10.1.1.2 has a next hop but no exit interface printed. That is normal for a static route configured with only a next-hop address; the router resolves the interface recursively at forwarding time.
• B 192.168.100.0/24 [20/0] via 203.0.113.1, 2d03h shows an age of “2 days, 3 hours” and no exit interface; BGP routes are always shown this way because BGP next hops are resolved recursively too.
• Connected routes have no next hop. The destination is on the local wire, so the router uses ARP (IPv4) or Neighbor Discovery (IPv6) to find the destination host’s MAC address directly.

3.1.e Administrative distance

Administrative distance (AD) is the first number inside the square brackets: [110/2] means AD 110. AD is a measure of how trustworthy the source of the route is. Lower is better. The router uses AD only when it learns the exact same prefix and mask from two or more different sources and has to pick one to install in the routing table.

Why is this necessary? Different protocols compute their metrics in completely different ways. OSPF cost and EIGRP composite metric and RIP hop count cannot be compared to each other; a route with OSPF cost 2 is not “better” than an EIGRP route with metric 3072 just because 2 is smaller. So Cisco assigns each route source a fixed believability score, and the source with the lowest AD wins.

A route with AD 255 is never installed in the routing table; it is treated as unreachable. Everything from 0 to 254 is usable.

The default AD of a static route can be changed by adding a number at the end of the ip route command. Raising it above a dynamic protocol’s AD is exactly how a floating static route works (objective 3.3.d).

3.1.f Metric

The metric is the second number in the brackets: [110/2] means metric 2. The metric is how a single routing protocol ranks multiple paths to the same destination. The lower the metric, the better the path. Each protocol defines its metric differently:

In the sample, R 192.168.7.0/24 [120/1] is one router hop away via RIP, while O IA 10.2.0.0/16 [110/3] has an OSPF cost of 3, which on a network of Gigabit links (cost 1 each) suggests three outgoing interfaces along the path, counting the final router’s interface onto the destination subnet.

Metrics are only compared between routes from the same protocol for the same prefix. If OSPF has two paths to 10.1.2.0/24 with costs 2 and 5, the cost-2 path is installed. If both paths have exactly equal metrics, OSPF (and EIGRP, RIP, and IS-IS) installs both and load-balances across them; this is called equal-cost multipath (ECMP). OSPF installs up to 4 equal-cost paths by default on most IOS versions (the maximum-paths command adjusts this).

3.1.g Gateway of last resort

The gateway of last resort is the next hop the router uses when no other route matches the destination. It is the router’s “when in doubt, send it here” address, and it comes from the default route 0.0.0.0/0.

In the sample, the line just above the routes says:

Gateway of last resort is 203.0.113.1 to network 0.0.0.0

and the route that created it is:

S*    0.0.0.0/0 [1/0] via 203.0.113.1

The asterisk in S* flags the route as a candidate default. When a router has no default route at all, the header reads Gateway of last resort is not set, and any packet whose destination does not match a more specific route is dropped (and the router sends an ICMP “destination unreachable” back to the source).

Default routes are the normal way a branch or edge router reaches “the rest of the Internet.” Instead of holding hundreds of thousands of Internet prefixes, the router holds one route saying “everything else goes to the ISP.” A default route can be static (S*) or learned dynamically; for example, OSPF can advertise one with default-information originate, in which case the code becomes O*E2.