The routing table is the “brain” a router consults for every single forwarding decision. If you can read a routing table fluently, you can diagnose most network problems in minutes instead of hours. Yet many beginners find routing table output intimidating — rows of codes, prefixes, distances, and metrics that look like a foreign language.
This article breaks the routing table down piece by piece, in plain English, using real Cisco IOS and Linux examples, so that by the end you can look at any routing table and immediately understand what it’s telling you.
What Is a Routing Table?
A routing table (also called the Routing Information Base, or RIB) is a data structure stored in a router’s memory that lists known destination networks and how to reach them. Every router — whether it’s a Cisco enterprise router, a home Wi-Fi router, or a Linux server — maintains one.
Think of it like a GPS app’s internal map database: it doesn’t store turn-by-turn instructions for every possible trip in advance; instead, it stores road segments (networks) and connections (next hops), and calculates the best path only when needed.
The Building Blocks of a Routing Table Entry
Every single entry in a routing table — regardless of vendor — is built from the same core components:
- Destination network (prefix and prefix length/mask)
- Route source (how the router learned this route — connected, static, or a routing protocol)
- Administrative distance (trustworthiness ranking of the source)
- Metric (cost value used to compare routes from the same source)
- Next-hop IP address (where to send packets destined for this network)
- Outgoing interface (which physical/logical port to use)
- Age/timestamp (how long ago this route was learned, for dynamic protocols)
Let’s examine each of these individually.
1. Destination Network (Prefix)
This is the network address and prefix length (subnet mask) that this entry describes — for example, 192.168.1.0/24 or 10.0.0.0/8. This is the “key” the router uses in its lookup during forwarding, applying the longest-prefix-match rule.
2. Route Source (Codes)
Cisco IOS uses single-letter codes to show how a route was learned. This is one of the most important things to understand. Here is the legend you’ll see at the top of show ip route output:
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated routeThe important ones for CCNA-level study are:
| Code | Meaning |
|---|---|
C | Directly Connected — the router has an interface configured in this network |
L | Local — a /32 (or /128 for IPv6) route representing the router’s own interface IP |
S | Static — manually configured by an administrator |
S* | Static route marked as a candidate default route |
O | OSPF — learned dynamically via OSPF |
D | EIGRP — learned dynamically via EIGRP |
B | BGP — learned via Border Gateway Protocol |
R | RIP — learned via Routing Information Protocol |
3. Administrative Distance (AD)
When a router learns about the same destination network from two or more different sources (e.g., both a static route and OSPF), it needs a way to decide which one to trust. That’s what Administrative Distance is for.
Administrative Distance is a number from 0–255 representing how “trustworthy” a route source is. Lower is more trusted.
| Route Source | Default Administrative Distance |
|---|---|
| Directly connected | 0 |
| Static route | 1 |
| EIGRP summary route | 5 |
| External BGP | 20 |
| Internal EIGRP | 90 |
| OSPF | 110 |
| IS-IS | 115 |
| RIP | 120 |
| External EIGRP | 170 |
| Internal BGP | 200 |
| Unknown/unreachable | 255 (never used) |
Key rule: AD is only used to choose between routes to the same destination network learned from different sources. It is never used to compare a /24 route against a /25 route — longest prefix match always takes priority over AD.
4. Metric
Once a router has decided which source to trust (via AD), if that same source offers multiple paths to the same destination, it uses the metric to pick the best one. Each routing protocol calculates its metric differently:
| Protocol | Metric Basis |
|---|---|
| RIP | Hop count (max 15) |
| OSPF | Cumulative interface cost (based on bandwidth) |
| EIGRP | Composite of bandwidth, delay, reliability, load |
| BGP | Complex path attributes (AS-path length, weight, local preference, etc.) |
| Static | No real metric; typically shown as 0 |
Lower metric = better/preferred path (in nearly every protocol).
5. Next-Hop IP Address
This tells the router: “To reach this network, send the packet to this IP address next.” The next-hop router must be directly reachable — usually on a shared subnet with the current router.
For directly connected and local routes, there is no next-hop IP because the destination is on a network the router itself is attached to.
6. Outgoing Interface
This is the actual physical or logical port the packet will be transmitted from — for example, GigabitEthernet0/1, Serial0/0/0, or Tunnel0.
7. Route Age
For dynamically learned routes, the routing table also tracks how long ago the route was learned or last updated. This is useful for troubleshooting — a route that keeps “flapping” (appearing and disappearing) will show a low, constantly-resetting age.
Full Example: Reading a Real Cisco Routing Table
Router# show ip route
Codes: L - local, C - connected, S - static, R - RIP, O - OSPF, D - EIGRP
* - candidate default, IA - OSPF inter area
Gateway of last resort is 203.0.113.1 to network 0.0.0.0
S* 0.0.0.0/0 [1/0] via 203.0.113.1
10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
O 10.1.1.0/24 [110/2] via 10.10.10.2, 00:14:32, GigabitEthernet0/1
C 10.10.10.0/30 is directly connected, GigabitEthernet0/1
L 10.10.10.1/32 is directly connected, GigabitEthernet0/1
D 192.168.5.0/24 [90/156160] via 10.10.10.6, 01:02:11, GigabitEthernet0/2Let’s decode the OSPF line piece by piece:
O 10.1.1.0/24 [110/2] via 10.10.10.2, 00:14:32, GigabitEthernet0/1
│ │ │ │ │ │ │
│ │ │ │ │ │ └─ Outgoing interface
│ │ │ │ │ └─ Age (14 min, 32 sec since learned)
│ │ │ │ └─ Next-hop IP address
│ │ │ └─ Metric (OSPF cost = 2)
│ │ └─ Administrative Distance (OSPF default = 110)
│ └─ Destination network and prefix length
└─ Route source code (O = OSPF)And the EIGRP line:
D 192.168.5.0/24 [90/156160] via 10.10.10.6, 01:02:11, GigabitEthernet0/2D= learned via EIGRP[90/156160]= AD of 90, EIGRP composite metric of 156160- Learned 1 hour, 2 minutes, 11 seconds ago
- Reachable via next-hop
10.10.10.6out interface Gi0/2
Visualizing How AD and Metric Interact
flowchart TD
A["Router learns route to 10.1.1.0/24"] --> B{Multiple sources for same network?}
B -- No --> C[Install the only known route]
B -- Yes --> D[Compare Administrative Distance]
D --> E{Same AD?}
E -- No --> F[Install route with LOWEST Administrative Distance]
E -- Yes --> G[Compare Metric]
G --> H[Install route with LOWEST Metric]Linux Routing Table Comparison
Linux routing tables are simpler in presentation but conceptually identical. View them with:
ip route showExample output:
default via 203.0.113.1 dev eth0 proto static metric 100
10.1.1.0/24 via 10.10.10.2 dev eth1 proto ospf metric 20
192.168.5.0/24 via 10.10.10.6 dev eth2 proto bird metric 20
10.10.10.0/30 dev eth1 proto kernel scope link src 10.10.10.1Here, proto shows the origin (kernel = directly connected, static, ospf, bird = a routing daemon), and metric plays a similar role to Cisco’s metric field, used to break ties between multiple routes to the same destination.
You can also view the classic (older-style) table format:
route -nDestination Gateway Genmask Flags Metric Iface
0.0.0.0 203.0.113.1 0.0.0.0 UG 100 eth0
10.1.1.0 10.10.10.2 255.255.255.0 UG 20 eth1
10.10.10.0 0.0.0.0 255.255.255.252 U 0 eth1| Column | Meaning |
|---|---|
| Destination | Target network |
| Gateway | Next hop (0.0.0.0 means directly connected, no next hop needed) |
| Genmask | Subnet mask |
| Flags | U = route is up, G = uses a gateway, H = host route |
| Metric | Route cost |
| Iface | Outgoing interface |
Python Example: Parsing a Routing Table Programmatically
Network engineers often need to parse routing tables for automation or auditing. Here’s a simple Python example using regular expressions to parse Cisco-style output:
import re
route_output = """
O 10.1.1.0/24 [110/2] via 10.10.10.2, 00:14:32, GigabitEthernet0/1
D 192.168.5.0/24 [90/156160] via 10.10.10.6, 01:02:11, GigabitEthernet0/2
"""
pattern = re.compile(
r"(?P<code>\w)\s+(?P<network>\S+)\s+\[(?P<ad>\d+)/(?P<metric>\d+)\]\s+"
r"via\s+(?P<nexthop>\S+),\s+(?P<age>\S+),\s+(?P<interface>\S+)"
)
for match in pattern.finditer(route_output):
print(match.groupdict())Output:
{'code': 'O', 'network': '10.1.1.0/24', 'ad': '110', 'metric': '2',
'nexthop': '10.10.10.2', 'age': '00:14:32', 'interface': 'GigabitEthernet0/1'}
{'code': 'D', 'network': '192.168.5.0/24', 'ad': '90', 'metric': '156160',
'nexthop': '10.10.10.6', 'age': '01:02:11', 'interface': 'GigabitEthernet0/2'}This kind of parsing is the foundation of network automation tools that audit routing tables across hundreds of devices.
Comparison Table: Cisco vs. Linux Routing Table Terminology
| Concept | Cisco IOS Term | Linux Term |
|---|---|---|
| Command to view table | show ip route | ip route show |
| Route source | Code letter (C, S, O, D, B…) | proto field (kernel, static, ospf, bgp…) |
| Trust ranking between sources | Administrative Distance | Not directly used the same way; relies on proto priority in routing policy/rules |
| Tie-breaker among same-source routes | Metric | metric field |
| Directly connected network | C code | proto kernel scope link |
| Router’s own IP on interface | L code (local, /32) | Shown in ip addr show, not routing table |
| Default route | S* or 0.0.0.0/0 | default via ... |
Best Practices
- Always check both AD and metric when a route looks “wrong” — a lower-preference protocol may be overriding a better one if AD is misconfigured.
- Use route summarization to keep tables small and lookups fast, especially in large environments.
- Label static routes with descriptions (using
ip route ... name <description>on some platforms) so their purpose is documented. - Regularly audit routing tables with automation scripts, especially in environments with dynamic routing protocols, to catch unexpected routes early.
- Understand your redistribution points — where static or connected routes get redistributed into a dynamic protocol — since AD often needs manual tuning there to avoid routing loops.
Troubleshooting Using the Routing Table
Scenario: A Route You Expect Isn’t Being Used
- Check if the route even exists:
show ip route <network> - If it exists but isn’t “active,” check for a competing route with a lower AD.
- Use
show ip protocolsto confirm the routing protocol is actually running and enabled on the right interfaces. - Check for route filtering (distribute-lists, route-maps) that might be suppressing the route.
Scenario: Route Flapping
- Look at the age column — does it keep resetting to near-zero?
- Check the physical layer (interface errors, flapping links) with
show interfaces. - Check routing protocol neighbor stability with
show ip ospf neighbororshow ip eigrp neighbors.
Scenario: Two Routes to Same Destination, Wrong One Is Active
- Compare their Administrative Distances.
- If AD is equal, compare metrics.
- Adjust AD manually via
distancecommand if you need to force a preference (e.g., preferring a static route over OSPF for a backup path).
Summary
A routing table entry is far less mysterious once broken into its components: what network it describes, how it was learned, how trustworthy that source is (AD), how good the specific path is (metric), and where to send the packet next (next-hop and interface). Mastering these five ideas lets you read any routing table on any platform — Cisco, Juniper, Linux, or cloud router — with confidence.
