How routers forward packets: the routing table, longest prefix match, AD and metrics

A packet's journey

When PC1 (192.168.1.10/24) sends to a server at 10.20.5.8, it first sees that the server is on another subnet, so it ARPs for its default gateway and sends the frame to the router's MAC address. The router then works through the same steps for every packet:

1. Check the frame's FCS and that it is addressed to this router; drop it otherwise.
2. Remove the Layer 2 header and check the IP header.
3. Look up the destination IP in the routing table and choose the best match.
4. Decrement the TTL (drop and send ICMP Time Exceeded if it reaches 0) and recalculate the header checksum.
5. Find the next hop's MAC address with ARP and send a new frame out of the chosen interface.

The IP addresses stay the same end to end; the frame is rebuilt at every hop. Modern routers do this in hardware using a pre-computed forwarding table (Cisco Express Forwarding), but the logic is the same.

Reading the routing table

R1# show ip route
Codes: L - local, C - connected, S - static, O - OSPF, D - EIGRP, B - BGP, * - candidate default

S*    0.0.0.0/0 [1/0] via 203.0.113.1
      10.0.0.0/8 is variably subnetted
O        10.0.0.0/8 [110/30] via 10.1.12.2, GigabitEthernet0/1
O        10.20.0.0/16 [110/20] via 10.1.12.2, GigabitEthernet0/1
S        10.20.5.0/24 [1/0] via 10.1.13.3
C        10.1.12.0/30 is directly connected, GigabitEthernet0/1
L        10.1.12.1/32 is directly connected, GigabitEthernet0/1

Each line shows the source code, the prefix, [administrative distance/metric], the next hop and the exit interface. C routes appear automatically for every interface that is up with an address, and L routes are the router's own addresses. The S* line is the default route, the "gateway of last resort" used when nothing else matches.

Longest prefix match

A destination often matches several routes. 10.20.5.8 matches 0.0.0.0/0, 10.0.0.0/8, 10.20.0.0/16 and 10.20.5.0/24. The router always uses the most specific one, the route with the longest prefix: here the /24 static route via 10.1.13.3. The administrative distance and metric of the other routes do not matter, because they describe different, larger networks.

This is why a /32 host route overrides everything, and why the default route is used only as a last resort. You can ask the router which route it would use with show ip route 10.20.5.8.

Administrative distance, metrics and ECMP

When two sources offer the same prefix, for example OSPF and a static route both know 10.20.0.0/16, the router installs only the one with the lower administrative distance (AD): connected 0, static 1, eBGP 20, EIGRP 90, OSPF 110, RIP 120, iBGP 200. When one protocol knows several paths to the same prefix, it picks the lowest metric: cost for OSPF, a bandwidth and delay calculation for EIGRP, hop count for RIP. If metrics are equal, the router can install several paths and share traffic across them (equal-cost multipath, ECMP).

In short: AD and metric decide what enters the table; longest prefix match decides which entry forwards each packet.

Real-world example: a firewall team added a static route for 10.20.5.0/24 to test a new server and forgot it. Months later the subnet moved to another site; OSPF learned the new path, but traffic kept failing. The old /24 static was more specific than the OSPF /16, so it won every time. show ip route 10.20.5.8 revealed the culprit in seconds.

Exam tip: when a question lists several routes and asks which one is used, first discard every route that does not match the destination, then pick the longest prefix. Only compare administrative distance when two routes have exactly the same prefix and length. Many candidates lose marks by choosing the lowest AD from routes of different lengths.