Determine how a router makes a forwarding decision by default

Now that you can read every field, the next skill is predicting which route the router actually uses for a given packet. Beginners frequently get this wrong because they apply the three rules in the wrong order. The order is fixed and non-negotiable:

1. Longest prefix match decides which entry in the routing table is used for a packet. This is the only rule applied at forwarding time.
2. Administrative distance decides which source gets to put its route into the table when two sources offer the same prefix and mask.
3. Metric decides which path a single protocol chooses when it knows several paths to the same prefix.

Rules 2 and 3 happen when the routing table is built. Rule 1 happens when each packet is forwarded. Keep that separation in mind and the exam questions become simple.

3.2.a Longest prefix match

When a packet arrives, the router compares its destination address with every route in the table. Several routes may match. The router picks the one with the longest prefix length, meaning the most specific route, the one that covers the fewest addresses. This is the longest prefix match rule, sometimes called “most specific route wins.”

Consider this routing table fragment:

S*    0.0.0.0/0 [1/0] via 203.0.113.1
O     10.0.0.0/8 [110/20] via 10.1.1.2, 00:10:00, GigabitEthernet0/0
D     10.1.0.0/16 [90/3072] via 10.1.1.3, 00:10:00, GigabitEthernet0/0
S     10.1.5.0/24 [1/0] via 10.1.1.4
C     10.1.5.128/25 is directly connected, GigabitEthernet0/1
L     10.1.5.129/32 is directly connected, GigabitEthernet0/1

Work through several destinations:

Notice that AD played no part in any of these decisions. The static route to 10.1.5.0/24 (AD 1) lost to the connected /25 for 10.1.5.200 not because of AD but because /25 is longer than /24. And for 10.1.7.1 the EIGRP /16 beat the OSPF /8 even though we never looked at AD 90 versus 110. Prefix length alone decided.

3.2.b Administrative distance

AD is applied when the router receives the same prefix with the same mask from two different sources and must choose which one to install. Only the winner appears in show ip route; the loser is kept in the protocol’s own database (for OSPF, the LSDB) and takes over automatically if the winner disappears.

Worked example: R1 learns 172.16.10.0/24 three ways:

• From RIP: 172.16.10.0/24, AD 120, metric 2
• From OSPF: 172.16.10.0/24, AD 110, metric 30
• From a static route: ip route 172.16.10.0 255.255.255.0 10.1.1.9, AD 1

The routing table shows only one line:

S     172.16.10.0/24 [1/0] via 10.1.1.9

Static (AD 1) beats OSPF (110), which beats RIP (120). The OSPF metric of 30 versus the RIP hop count of 2 is irrelevant because metrics from different protocols are never compared. If the administrator later removes the static route, the OSPF route (the next lowest AD) is installed within seconds.

A second example that trips people up: R1 learns 192.168.50.0/24 from EIGRP as an external route (AD 170) and from OSPF (AD 110). Even though people think of EIGRP as “better” than OSPF because its internal AD is 90, this specific EIGRP route is external, so OSPF at 110 wins.

3.2.c Routing protocol metric

Metric is the tiebreaker within one protocol for one prefix. OSPF, for example, runs its SPF calculation and finds every possible path to 10.1.2.0/24; it hands the routing table only the path (or paths) with the lowest total cost.

Worked example: R1 runs OSPF and has two paths to 10.50.0.0/24:

• Path A: R1 - R2 - R5, all Gigabit interfaces with default cost 1 each. OSPF adds the cost of every outgoing interface along the way, including R5’s interface onto the destination LAN: R1 to R2 (1) + R2 to R5 (1) + R5’s LAN interface (1) = total cost 3.
• Path B: R1 - R3 - R4 - R5, three Gigabit links plus R5’s LAN interface, total cost 4.

OSPF installs only Path A:

O     10.50.0.0/24 [110/3] via 10.1.12.2, 00:03:10, GigabitEthernet0/1

If the R2 - R5 link fails, OSPF recalculates and installs Path B with metric 4. If both paths had cost 3, OSPF would install both lines with the same [110/3] and load-balance between them.

A second example using RIP: two RIP paths to 192.168.7.0/24, one 1 hop away, one 3 hops away. RIP installs the 1-hop path: [120/1]. Note that RIP ignores bandwidth entirely, so a 1-hop path over a slow serial link beats a 3-hop path over Gigabit Ethernet. That weakness is a major reason OSPF and EIGRP replaced RIP.

Putting all three rules together

Here is a complete worked example that exercises the full decision order. R1 receives the following candidate routes:

• Static default 0.0.0.0/0 via 203.0.113.1
• OSPF 172.16.0.0/16, cost 10, via 10.1.12.2
• Static 172.16.4.0/22 via 10.1.12.3
• OSPF 172.16.5.0/24, cost 4, via 10.1.12.2
• EIGRP internal 172.16.5.0/24, metric 3072, via 10.1.12.4

First the table is built. 172.16.5.0/24 arrives from two sources with the identical prefix and mask, so AD decides: EIGRP internal (90) beats OSPF (110), and only the EIGRP version is installed. Every other prefix is unique, so it is installed as-is. The resulting table is:

S*    0.0.0.0/0 [1/0] via 203.0.113.1
O     172.16.0.0/16 [110/10] via 10.1.12.2, 00:20:00, GigabitEthernet0/1
S     172.16.4.0/22 [1/0] via 10.1.12.3
D     172.16.5.0/24 [90/3072] via 10.1.12.4, 00:20:00, GigabitEthernet0/1

Now forward packets:

• Destination 172.16.5.77: matches /0, /16, /22 (172.16.4.0/22 spans 172.16.4.0 to 172.16.7.255), and /24. Longest is /24, so the packet goes to 10.1.12.4 (EIGRP).
• Destination 172.16.6.1: matches /0, /16, /22. Longest is /22, so it goes to 10.1.12.3 (static).
• Destination 172.16.99.1: matches /0 and /16. Goes to 10.1.12.2 (OSPF).
• Destination 192.0.2.5: matches only /0. Goes to 203.0.113.1.