"Which route will the router use to forward this packet?" is one of the most testable topics in CCNA routing. The logic is deterministic — if you know the two rules and apply them in the right order, you will get the right answer every time.
Rule 1: Longest Prefix Match (Most Specific Route)
A router forwards a packet using the most specific route that matches the destination IP address. Most specific means the route with the highest prefix length — /24 is more specific than /16, which is more specific than /8.
The router does not consider administrative distance or metric until it has found all matching routes. It first identifies every route whose prefix covers the destination, then picks the most specific one.
Example:
The routing table contains:
- 10.0.0.0/8 via 172.16.1.1
- 10.10.0.0/16 via 172.16.1.2
- 10.10.10.0/24 via 172.16.1.3
A packet arrives destined for 10.10.10.50. All three routes match. The most specific match is 10.10.10.0/24 (/24 beats /16 beats /8). Traffic goes to 172.16.1.3.
This is the longest prefix match rule. It always takes priority over administrative distance.
Rule 2: Administrative Distance (When Prefixes Match Exactly)
Administrative distance (AD) is the trustworthiness rating of a route source. Lower AD means more trusted. If two routes have identical prefix lengths, the one with lower AD wins.
| Route Source | Administrative Distance |
|---|---|
| Connected | 0 |
| Static | 1 |
| EIGRP (internal) | 90 |
| OSPF | 110 |
| RIP | 120 |
Example: both OSPF and RIP advertise 192.168.1.0/24. OSPF AD is 110, RIP AD is 120. OSPF wins and is installed in the routing table.
Typically only the lower-AD route appears in show ip route. The higher-AD route is held by the routing protocol as a backup but not shown as active.
Rule 3: Metric (Same Protocol Tiebreaker)
If two routes have identical prefix length and identical AD (same routing protocol), the metric decides. Lower metric wins. OSPF uses cost (based on bandwidth). EIGRP uses a composite metric. RIP uses hop count.
Reading the Routing Table
R1# show ip route
O 10.1.1.0/24 [110/2] via 192.168.1.2, GigabitEthernet0/0
S 10.1.0.0/16 [1/0] via 192.168.1.3
C 192.168.1.0/24 is directly connected, GigabitEthernet0/0
The format [AD/metric] appears in brackets after the prefix.
A packet destined for 10.1.1.5:
- Matches 10.1.1.0/24 (OSPF, /24)
- Matches 10.1.0.0/16 (Static, /16)
- Longest prefix: /24 wins
- Route used: OSPF via 192.168.1.2
The static route's lower AD (1 vs 110) is completely irrelevant because the OSPF route is more specific.
The Default Route
The default route 0.0.0.0/0 matches every destination but has the shortest possible prefix (/0). It is the route of last resort — used only when no more specific route matches. If no default route exists and no specific route matches, the packet is dropped.
Common Exam Trap
A routing table has a static route to a /16 network and an OSPF route to a /24 subnet within that /16. A packet destined for a host in the /24 range — which route is used?
Many candidates see the static route's AD of 1 versus OSPF's 110 and pick the static route. This is wrong. The OSPF /24 is more specific. Longest prefix match is applied before AD is ever considered.
The rule order is: prefix length first, then AD, then metric.
Practice CCNA routing questions with routing table output scenarios to make this instinctive before exam day.
Reading a Real Routing Table Under Pressure
Here is a routing table with 10 routes. Work through the three questions that follow.
**` R1# show ip route Codes: L - local, C - connected, S - static, R - RIP, O - OSPF
Gateway of last resort is 10.0.0.1 to network 0.0.0.0
OE2 0.0.0.0/0 [110/1] via 10.0.0.1, GigabitEthernet0/0 C 10.0.0.0/30 is directly connected, GigabitEthernet0/0 L 10.0.0.2/32 is directly connected, GigabitEthernet0/0 O 10.1.0.0/16 [110/3] via 10.0.0.1, GigabitEthernet0/0 O 10.1.10.0/24 [110/2] via 10.0.0.1, GigabitEthernet0/0 S 10.1.10.0/24 [1/0] via 192.168.1.1 O 10.1.10.128/25 [110/4] via 10.0.0.1, GigabitEthernet0/0 C 192.168.1.0/24 is directly connected, GigabitEthernet0/1 L 192.168.1.1/32 is directly connected, GigabitEthernet0/1 S 172.16.0.0/12 [1/0] via 192.168.1.254 ***`
Question 1: A packet arrives destined for 10.1.10.50. Which route is used?
Three routes match: 10.1.0.0/16, 10.1.10.0/24 (two of them, OSPF and static), and the default route 0.0.0.0/0.
Most specific first: /24 beats /16 beats /0. Narrow to the two /24 routes: OSPF [110/2] and Static [1/0].
Both are /24. Now apply administrative distance: Static is 1, OSPF is 110. Static wins.
Answer: *S 10.1.10.0/24 [1/0] via 192.168.1.1*
Note that the OSPF route for 10.1.10.0/24 exists but is not in the routing table as active — the static route displaced it. You typically only see the winning route in *show ip route*. The OSPF route is held by the OSPF process but not installed.
Question 2: A packet arrives destined for 10.1.10.200. Which route is used?
Matching routes: 10.1.0.0/16 (/16), 10.1.10.0/24 (static and OSPF), 10.1.10.128/25 (/25), and 0.0.0.0/0 (/0).
Most specific: /25 (10.1.10.128/25 covers 10.1.10.128 through 10.1.10.255 — the .200 address falls in this range). /25 beats /24 beats /16 beats /0.
Answer: *O 10.1.10.128/25 [110/4] via 10.0.0.1*
The static route to 10.1.10.0/24 loses here because the OSPF /25 is more specific.
Question 3: A packet arrives destined for 172.20.5.1. Which route is used?
Matching routes: 172.16.0.0/12 covers 172.16.0.0 through 172.31.255.255. 172.20.5.1 falls inside this range (/12 with block size 16 in the second octet: 16, 32 — so 172.16.x.x through 172.31.x.x). The default route 0.0.0.0/0 also matches.
Most specific: /12 beats /0.
Answer: *S 172.16.0.0/12 [1/0] via 192.168.1.254*
Floating Static Routes
A floating static route is a static route configured with a higher AD than the primary routing protocol. It sits in the background, invisible in the routing table as long as the primary protocol's route is present. When the primary route disappears (protocol fails, link goes down), the floating static route drops into the table as a backup.
**` R1(config)# ip route 10.2.0.0 255.255.0.0 192.168.2.1 130 **`
The *130* at the end is the administrative distance for this specific static route. OSPF has AD 110. A floating static with AD 130 will be beaten by OSPF while OSPF is running. If OSPF loses the route (OSPF adjacency drops, the advertising router disappears), this static route takes over.
This is commonly used as a backup path over a different WAN link. Primary: OSPF-learned route over MPLS. Backup: floating static over internet VPN, only active when the MPLS circuit fails.
Exam question: "R1 has an OSPF route to 10.2.0.0/16 and a static route to 10.2.0.0/16 with AD 130. Which route is in the routing table?"
The OSPF route (AD 110) beats the static route (AD 130). The static is the floating backup and is not installed. If OSPF were removed, the static takes over.
The ip route 0.0.0.0 0.0.0.0 Trap
The default route (*ip route 0.0.0.0 0.0.0.0 [next-hop]*) is the route of last resort. Any packet with no more specific matching route gets forwarded to the next hop in the default route.
Candidates confuse the default route with a summary route. They are different things.
A default route forwards all unmatched traffic to a single next hop. It matches every destination because /0 matches everything, but it is always the least specific match.
A summary route is a manually or automatically generated route that represents a range of more specific routes with a single, shorter prefix. *ip route 10.0.0.0 255.0.0.0 [next-hop]* is a summary route covering all of 10.x.x.x. If R1 also has specific routes like 10.1.1.0/24 and 10.1.2.0/24, those more specific routes win for traffic destined to those subnets. The summary only handles destinations that match the /8 but have no more specific route.
The exam question: "R1 has *ip route 0.0.0.0 0.0.0.0 192.168.1.1* and *ip route 10.0.0.0 255.0.0.0 192.168.1.2*. A packet destined for 10.5.5.5 arrives. Which route is used?"
The /8 (10.0.0.0/8) is more specific than /0 (0.0.0.0/0). The traffic goes to 192.168.1.2, not 192.168.1.1.
The gateway of last resort shown in *show ip route* is the next hop from the default route. "Gateway of last resort is 192.168.1.1 to network 0.0.0.0" means a default route exists pointing to 192.168.1.1.
When Two OSPF Routes Have Equal Cost
OSPF installs all routes with equal cost to the same destination in the routing table simultaneously. This is equal-cost multipath (ECMP) routing, and OSPF supports up to 16 ECMP paths by default (configurable with *maximum-paths*).
**` O 10.3.0.0/24 [110/2] via 10.0.1.1, GigabitEthernet0/0 [110/2] via 10.0.2.1, GigabitEthernet0/1 **`
Both paths have cost 2 (same OSPF metric). Both are installed. The router load-balances traffic across both next hops using per-destination load balancing by default (all packets to the same destination use the same path; different destinations use different paths).
The exam asks: "R1 has two OSPF routes to 10.3.0.0/24 with equal cost. What happens?"
Both routes are installed. Traffic is load-balanced across both paths. This is ECMP and it is normal OSPF behaviour.
If you want to disable ECMP and use only one path: *maximum-paths 1* under *router ospf*. This forces OSPF to install only the single best route even when costs are equal.
Route Redistribution Confusion
Route redistribution takes routes learned from one routing protocol and injects them into another. The result is a route that appears in the routing table from a protocol that did not learn it natively.
Example: a static route redistributed into OSPF appears in other routers' tables as an OSPF external route (type O E1 or O E2). The AD is still OSPF's 110, but the metric behavior differs from internal OSPF routes.
The exam scenario: "R3 has both an OSPF internal route and a redistributed RIP route for the same 10.5.0.0/24 prefix. OSPF has AD 110, RIP has AD 120. What is installed in the routing table?"
The OSPF route wins (AD 110 < 120). But wait — the redistributed RIP route arrives through OSPF redistribution. Its AD in the routing table depends on how it was redistributed, not the source protocol.
If RIP routes are redistributed into OSPF, they appear as OSPF external routes (O E2) with AD 110, not AD 120. The AD of OSPF (110) applies, not RIP's AD (120). This is the trap: once a route is redistributed into OSPF, it carries OSPF's AD, not the source protocol's AD.
Correct understanding: redistribution makes routes appear in the target protocol. The target protocol's AD applies to all routes it carries, including redistributed ones. OSPF-redistributed routes have AD 110 regardless of their original source.
Practice Question Sets
The best way to lock in route selection logic is working through real exam questions with immediate feedback. Pick a session size that fits your schedule: