9.4 Routing Tables

Introduction

Routing tables are the core reference books that routers use to decide where to send packets next. Every time a router receives an IP packet, it looks into its routing table to choose the best outgoing path. Understanding how that decision is made is essential before you explore how routes are created by static or dynamic methods.

What a Routing Table Contains

At a high level, a routing table is a list of network destinations and how to reach them. Each entry, often called a route, describes a particular destination network, how specific that destination is, where to send packets for it, and additional information that helps compare one route with another.

A simplified view of a routing table entry is:

In real devices more fields may appear, such as timers, tags, and flags, but the basic idea remains the same. For every known network, the router stores at least a destination, a mask or prefix, and either a next hop or an outgoing interface.

Connected, Static, and Dynamic Routes in the Table

The routing table does not care how a route was created. It only stores the final usable entries. However, for troubleshooting and design, it is important to know that different kinds of routes appear together in one table.

Directly connected networks are created automatically when an interface is configured with an IP address and is in an up state. The router knows that any host within that network can be reached directly on that interface. These routes usually look like this conceptually:

Static routes are manually configured by an administrator and then appear in the same table. They specify a destination and a next hop or interface. Dynamic routes are installed by routing protocols. In the table, you can typically identify both by a field that indicates the source of the route, for example S for static, or particular letters for specific routing protocols.

Even though the current chapter does not dive into how static or dynamic routing work internally, remember that all of them ultimately produce entries that live together inside the same routing table.

Longest Prefix Match

When a router receives a packet, it must decide which single route from the routing table should be used. Multiple routing entries might match the destination IP, but one must be chosen. The key rule that routers use is called the longest prefix match rule.

The destination IP address of the packet is compared with each route’s network and prefix. The prefix length tells how many bits are fixed for that network. The route with the most specific match, that is with the longest prefix length, is selected.

For example, consider these entries:

If the destination IP of a packet is 10.1.2.45, it matches all four entries, because 10.1.2.45 is inside all of those ranges. The router will select the /24 route, because it has the longest prefix and is therefore the most specific.

This rule is fundamental. It is applied before considering metrics or other tie breakers. Metrics and other values only matter among routes that have the same destination prefix and prefix length.

Default Routes in the Table

A default route is a special entry that matches any destination that does not have a more specific route. In IPv4 the default route is represented as destination 0.0.0.0 with a prefix length of 0. Its mask is 0.0.0.0. In IPv6 the default route is ::/0.

In a routing table the default route is often the least specific entry, with the shortest possible prefix. Because of the longest prefix rule, the default route only gets used if no other route matches. It acts as a final catch-all path.

A typical conceptual default route entry looks like this:

If a packet’s destination does not belong to any known network, the router will fall back to this default entry and send the packet to the specified next hop. This is particularly common on small routers that send all unknown traffic toward an internet service provider.

Routing Table Lookup Process

The decision process that a router uses for each packet can be summarized into a simple sequence. The actual implementation is optimized for performance, but the logical steps are:

1. Take the destination IP address of the packet.
2. Compare it against all routes in the table to find all matching prefixes.
3. Select the matching route with the longest prefix length.
4. If no route matches, drop the packet and optionally send an error.
5. Use the next hop or outgoing interface from the selected route.
6. Forward the packet to that next hop or onto the appropriate network.

In practice, routers use data structures designed to make this process extremely fast. You do not need to know the internal algorithms in detail at a beginner level. Focus on the logical behavior that you would use for reasoning and troubleshooting.

Administrative Distance and Metrics in the Table

Sometimes the same destination network can be learned through multiple sources, for example from a static configuration and from one or more dynamic protocols. In such cases the router still keeps all routes internally, but typically only one route for a given prefix is installed in the main routing table for forwarding purposes.

Two kinds of values influence which route is installed when they share the same destination and prefix length.

The administrative distance describes how much the router trusts the source of the route. It is associated with the origin of the route, not with its path characteristics. A lower distance is preferred over a higher one. Since this topic belongs to a separate chapter, here you only need to know that routing tables usually display this as part of each entry, so you can see why one route replaced another.

The metric describes the cost of using a particular route as defined by the routing protocol that created it. Metrics may represent path length, delay, bandwidth, or a combination of factors. For a given protocol, the route with the lowest metric is preferred.

When you look at a routing table, you will often see both pieces of information in some form. For example, a notation where an entry is marked with its administrative distance in one part and its metric in another. The detailed meaning depends on the vendor and is covered by specific routing protocol chapters.

At a high level, for routes to the same exact prefix:

1. The router first compares administrative distances of their sources.
2. The route with the lowest distance is preferred.
3. If administrative distances are equal, the router compares metrics.
4. The route with the lowest metric is preferred.

If both administrative distance and metric are the same, for example two equal paths learned through the same protocol, the router may install multiple routes to provide load balancing. From the perspective of the routing table, this can appear as multiple entries for the same destination that share equal cost.

Directly Connected Networks and the Routing Table

When a router has an interface configured with an IP address and mask, the router automatically considers the corresponding network as directly connected. This has two important consequences in the routing table.

First, there is a network-level entry representing that entire subnet. Second, hosts that are on the same subnet can be reached without an explicit next hop router. The outgoing interface acts as the final step. The router simply sends frames onto that link to reach any host within the subnet.

To reach individual hosts, the router still needs link layer information, which is obtained using separate mechanisms that are not part of the routing table itself. The routing table only states that any address in that subnet is reachable directly via a specific interface.

Connected routes typically appear with the lowest possible administrative distance, so they tend to override other learned routes to the same prefix.

Recursive Lookup and Next Hop Resolution

Sometimes a routing table entry specifies a next hop IP address that is itself reachable through another route. In that case the router performs a recursive lookup. The process is:

1. Use the routing table to find the route to the final destination. This gives a next hop, not necessarily a directly connected network.
2. Perform another routing table lookup for the next hop address.
3. Find a connected route or another more specific route that tells which interface or further next hop to use.

This recursion continues until the router reaches a directly connected network that can physically forward the packet.

To avoid excessive processing, routers usually limit recursion depth and optimize their tables so that installed routes already contain enough information for fast forwarding. Conceptually though, you can think of the router chaining decisions until it reaches an interface that leads to the correct direction.

Route Aging and Stability

Dynamic routes are often subject to aging and timers. Routing protocols may remove entries that are no longer valid. When this happens, the corresponding entries are removed from the routing table. Connected routes may disappear if an interface goes down. Static routes usually stay until an administrator removes them, unless they are tied to an interface state.

Because of these changes, the routing table is not a fixed object. It evolves as network conditions, links, and protocols change. The router always uses the current table in memory. For troubleshooting, it is essential to look at the live routing table to see which paths the router actually believes are valid at that moment.

Reading and Interpreting Routing Tables

Different operating systems and network devices present routing tables with their own syntax, but the basic elements repeat.

For example, a routing table on a typical device might show destination networks, prefix lengths, next hops, outgoing interfaces, and protocol codes indicating how the route was learned. The most useful questions to ask when reading such a table are:

Which networks does this router believe it can reach?
For a given destination, which route is actually being used and why?
Are there multiple equal cost paths for some networks?
Are there any default routes and where do they point?

If you can answer these questions by looking at the routing table, you have a solid practical understanding of its role. Later chapters on specific routing methods will build on this by showing how new entries are added, modified, or removed, and how those changes affect packet forwarding behavior across the network.