3.1Reading the routing table and the forwarding decision

The routing knowledge CCNA tests is not rote term memorization; it is the diagnostic skill to look at real show ip route output and explain, with justification, where a given packet will actually be forwarded and why one route is chosen over another. The routing table is the only table a router consults for its forwarding decision, so correctly reading each line—and the tie-break rules when routes compete—is the starting point of troubleshooting.

3.1.1Components of a routing table entry

A typical line reads as follows: O 10.1.1.0/24 [110/65] via 192.168.1.2, 00:05:12, GigabitEthernet0/0. The leading O is the code, 10.1.1.0/24 is the prefix and mask, [110/65] is [AD/metric], via 192.168.1.2 is the next hop, and the trailing GigabitEthernet0/0 is the exit interface.

• The routing protocol code is the 1-2 letters showing how the route was learned: C = directly connected, L = local (the interface's own /32), S = static, O = OSPF, D = EIGRP, R = RIP, B = BGP. O IA marks an OSPF inter-area route, and * marks a candidate default (e.g., S*).
• The prefix / network mask is the destination network and its extent (10.1.1.0/24). The forwarding decision checks whether the destination IP falls within this prefix. The next hop is the IP of the adjacent router to hand the packet to next, and the accompanying exit interface is the port to send it out of.
• The AD (left of the [) is the trust level of the route's source (smaller = more trusted): directly connected 0, static 1, EIGRP 90, OSPF 110, RIP 120. The metric (right of the [) is the cost of the route within a single protocol (bandwidth-based cost for OSPF, hop count for RIP). AD compares across sources; metric compares within a source—two different axes.
• The gateway of last resort is the final destination for a packet that matched no prefix. It appears at the top of show ip route as, e.g., Gateway of last resort is 203.0.113.1 to network 0.0.0.0, letting you confirm at a glance whether a default route (0.0.0.0/0) is set.

3.1.2The forwarding decision order: longest match -> AD -> metric

• Step 1: longest match. When the destination IP matches multiple prefixes, the route with the longest (most specific) mask wins unconditionally. If a destination matches both 10.1.1.0/24 and 10.0.0.0/8, the /24 is chosen even if the /8 has a smaller AD—prefix-length comparison happens before AD.
• Step 2: AD. When multiple sources (say, static and OSPF) offer the same prefix, only the source with the smallest AD is installed in the routing table. The losing route never appears in the table at all.
• Step 3: metric. Within the chosen protocol, when several routes reach the same prefix, the one with the smallest metric wins. Multiple routes with equal metrics share traffic via equal-cost load balancing.

Suppose you are troubleshooting branch router R1 and get a report that "traffic to 10.1.1.50 is taking an unexpected path—the slow backup link." Looking at show ip route, two lines catch your eye: O 10.1.0.0/16 [110/2] via 192.168.0.2 (the fast primary) and S 10.1.1.0/24 [1/0] via 172.16.9.9 (a hand-entered static route pointing at the slow backup). 10.1.1.50 falls inside both prefixes, and here the tempting but wrong entry point is to think "the static route's AD=1 is smaller than OSPF's AD=110, so static should win." Forwarding is decided by longest match first, and since /24 has a longer (more specific) mask than /16, the /24 static route is chosen before AD is ever compared—which is exactly why traffic drifted onto the slow link. Once the cause clicks, the fix is clear: question whether that /24 static route is truly needed, and if not, remove it and let the /16 OSPF route aggregate the traffic; or deliberately float the static route (set its AD higher than OSPF, i.e., a floating static) so the design becomes "use OSPF while the primary is up, fall back to static only when it fails." Diagnosing solely on the belief that "smaller AD wins" makes you miss the first-step prefix-length decision—the single most common shape of routing misdiagnosis in the field.

3.1.3Section summary

• A show ip route line consists of code, prefix/mask, [AD/metric], next hop, and exit interface, and the leading gateway of last resort shows whether a default route exists
• Forwarding follows longest match-> AD -> metric; a longer (more specific) mask wins even with a larger AD
• AD is source trust (connected 0 / static 1 / EIGRP 90 / OSPF 110 / RIP 120); metric is intra-protocol cost—two different axes