# Routing table

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/routing-table

## Quick definition

A routing table is like a map stored inside a router or computer. It lists all the known networks and tells the device which direction to send data to reach those networks. When a packet arrives, the device looks at the destination address and checks the table to find the best next stop. This process happens for every packet traveling across a network.

## Simple meaning

Imagine you are the driver of a delivery truck in a huge city. You have a list of addresses where you need to deliver packages, but you do not know every street by heart. What you really need is a map with clear directions. A routing table is exactly that kind of map, but for computers and networks.

Every device that sends data over a network, whether it is a home computer, a company server, or a giant router in a data center, uses a routing table. The table is not a physical piece of paper. It is a file stored in the device's memory. The table contains a list of destination network addresses. Alongside each destination, the table tells the device which neighbor router to send the data to next. This neighbor is called the next hop. The table also includes a metric, which is a number that tells how good or efficient that route is. Lower numbers usually mean better paths.

When a data packet arrives at a router, the router looks at the destination IP address in the packet. It then searches its routing table to find a matching entry. If the router finds a match, it forwards the packet to the next hop listed in that entry. If there are multiple matches, the router picks the one with the longest prefix match, meaning the most specific route. If no match exists, the router may use a default route, often referred to as the gateway of last resort. Think of a default route as a general direction you take when you have no other clue where to go.

Routing tables can be built in two main ways. Static routing means a network administrator manually enters each route. Dynamic routing means the router uses a routing protocol, such as OSPF or BGP, to automatically learn about networks from other routers. Both methods have their place. Static routes are simple and secure but do not adapt when the network changes. Dynamic routes require more complex setup but can automatically react to failures or congestion.

A routing table does not remember the whole path to a destination. It only remembers the next step. This is called hop-by-hop routing. Each router along the path makes its own independent decision based on its own table. This design makes the internet scalable because no single router needs to know the entire world map.

Without routing tables, data packets would wander around the network like lost tourists with no map. They might never reach their destination. The routing table is the fundamental mechanism that gives direction to every packet traveling across a network, from a local office to the other side of the planet.

## Technical definition

A routing table is a data structure stored in the memory of a network device, typically a router, layer 3 switch, or a host running a routing stack. It contains entries, or routes, that associate destination network prefixes with forwarding information. The primary purpose of a routing table is to provide the device with the information necessary to make forwarding decisions for each incoming IP packet.

The core components of a routing table entry include the destination network address and its subnet mask, which together define the destination prefix. The next hop address specifies the IP address of the neighboring router to which the packet should be forwarded. The outgoing interface indicates which physical or logical port on the device should be used to send the packet. The metric, also known as the administrative distance or cost, is a numerical value that indicates the trustworthiness or preference of a route. When a router learns the same destination from multiple sources, the route with the lowest total metric is installed in the routing table. The route type field identifies how the route was learned, such as directly connected, static, or via a dynamic routing protocol like OSPF, EIGRP, BGP, or RIP.

Forwarding decisions are made using a process called longest prefix match. When a packet arrives with a destination IP address, the router examines its routing table for all entries whose prefix matches the destination. The entry with the longest subnet mask, meaning the most specific route, is selected. If no specific match is found, a default route, commonly represented as 0.0.0.0/0, is used. This hierarchical matching ensures that packets are sent along the most precise path available.

Routing tables in dynamic environments are populated by routing protocols that exchange reachability information between routers. Link-state protocols like OSPF build a complete map of the network topology and then calculate the shortest path using algorithms such as Dijkstra's. Distance-vector protocols like RIP maintain only the distance and direction to each network, sharing their table with neighbors periodically. Path-vector protocols like BGP focus on policy and path attributes rather than just metrics. Each protocol uses its own metric, such as OSPF cost based on link bandwidth, or BGP path attributes including AS path length.

In modern enterprise and service provider networks, hardware forwarding tables or TCAM (Ternary Content-Addressable Memory) are often used separately from the software routing table to achieve wire-speed forwarding. The routing table is maintained in software by the routing process, and the best routes are then programmed into the forwarding table. This separation allows for high performance while maintaining flexibility.

Virtualization and cloud computing add another layer. In platforms like AWS, VPC routing tables are virtual resources that control traffic between subnets, internet gateways, and VPN connections. Each subnet is associated with one routing table, and the table determines whether traffic stays inside the VPC or flows to an external network. In Azure, user-defined routes (UDR) allow similar control. These virtual routing tables abstract the underlying physical hardware but follow the same logical principles.

Understanding routing tables is essential for passing IT certification exams such as CCNA, Network+, and AWS SAA. Questions often test the ability to interpret a routing table, determine the next hop for a given destination, identify the longest prefix match, and understand the impact of administrative distance and metric.

## Real-life example

Think of a large airport and the control center that coordinates all arriving and departing flights. The control room has a big board showing all the gates and runways, along with which flights are assigned to which locations. This board is like a routing table.

Now imagine you are a passenger arriving at the airport and you need to get to gate B12 to catch your connecting flight. You do not need to know the entire layout of the airport from memory. You look at the electronic display boards hanging from the ceiling that list all flights and their gate numbers. This board is exactly like a routing table entry for a specific destination. Your flight number is the destination network, and the gate number is the next hop. You follow the signs pointing to that gate, and along the way, you might pass through security checkpoints and moving walkways, each acting like a router forwarding you toward your final destination.

If the board says gate B12 is closed, it will show an alternative gate. This is like a router updating its routing table when a link goes down. The airport control center communicates these changes to all the display boards automatically, similar to how dynamic routing protocols update routing tables across a network. Passengers who just follow the boards will be redirected without having to know the whole airport plan.

Another analogy is a postal sorting office. When a letter arrives addressed to a specific city, the postal worker does not drive the letter all the way to that city. They look at a sorting table that tells them which outgoing truck to put the letter on. That truck is the next hop. The sorting table is the routing table. The postal worker does not care about the entire journey of the letter. They only care about the next step. Each sorting office along the route does the same thing until the letter reaches its final mailbox.

In both examples, the fundamental idea is the same. The routing table provides a simple, efficient way to make forwarding decisions without needing a global view. It breaks a complex journey into a series of simple hops. This is why routing tables are so powerful and why they are used in every network device that handles IP traffic.

## Why it matters

Routing tables matter because they are the mechanism that makes data delivery possible in any IP-based network. Without routing tables, every device would either need to know the entire internet topology or would be unable to send data beyond its immediate neighbors. Neither option is practical for a global network like the internet.

For IT professionals, understanding routing tables is critical for network design, troubleshooting, and security. When a network connection fails, the first step is often to check the routing tables on the relevant routers to see if the correct path exists. If a route is missing or has a high metric, traffic may be misdirected or blackholed. Knowing how to interpret the output of commands like show ip route on Cisco devices or route print on Windows is a fundamental skill.

In cloud environments, routing tables are equally important. Misconfigured VPC route tables in AWS can cause applications to be unreachable or data to leak to unintended destinations. Security groups and network ACLs are common topics, but the routing table is what actually moves traffic. A route misconfiguration can silently break connectivity while all other security settings look correct.

Routing tables also affect performance. A suboptimal route with a high metric or long path can increase latency and reduce throughput. Tuning routing protocols and monitoring routing tables helps engineers maintain efficient, resilient networks. When a router fails, dynamic routing protocols update the tables of neighboring routers, allowing traffic to be rerouted automatically. This convergence speed is a key design goal for enterprise networks.

Finally, routing tables are a core concept in multiple IT certification exams. They appear in CCNA, Network+, Security+, AWS SAA, Azure AZ-104, Google ACE, and even A+ at a basic level. Mastering routing tables gives candidates a strong foundation for understanding how data moves, which is essential for nearly every IT role.

## Why it matters in exams

Routing tables are a high-frequency topic across many IT certification exams. For the CompTIA Network+ exam, you will need to understand the purpose of a routing table, the meaning of entries such as destination network, next hop, and interface, and how to interpret a simple routing table to determine the path traffic takes. Questions often present a table and ask which interface a packet will exit for a given IP address. You must apply the longest prefix match rule.

For the Cisco CCNA exam, routing tables are even more central. You must know how to configure static routes and default routes on Cisco IOS devices. You must understand administrative distance and how it influences route selection when multiple routing protocols are in use. You will need to read and analyze the output of show ip route and explain why the router chose a particular path. Exam scenarios often involve troubleshooting a connectivity issue by examining the routing table on intermediate routers.

On the AWS SAA (Solutions Architect Associate) exam, routing tables appear in the context of VPCs. You must understand that each subnet in a VPC is associated with a route table, and the table controls traffic flow between subnets, internet gateways, NAT gateways, and VPN connections. A common question describes a situation where an EC2 instance cannot access the internet. You will need to identify whether the issue is a missing default route in the route table or a misconfigured internet gateway. Similarly, the Azure AZ-104 exam covers user-defined routes and route tables within virtual networks.

In the CompTIA Security+ exam, routing tables are less central but still appear in the context of network segmentation and secure architecture. You might see a question about preventing traffic between two network segments. The correct answer may involve configuring a routing table to omit a route or using access control lists in combination with routing.

The Google ACE (Associate Cloud Engineer) exam also includes routing in VPC networks. You must understand how to create and modify VPC route tables and how routes are propagated from Cloud Router.

For the A+ exam, routing tables appear in the context of basic network configuration on a host. You may need to know how to view the routing table on Windows using the route print command or on Linux using ip route show. You might need to add a static route to reach a specific network.

Across all exams, the key is not just memorizing definitions but applying the concept in scenarios. You will be tested on your ability to diagnose why traffic is not reaching its destination, which route will be chosen when multiple matches exist, and how changes to a routing table affect network behavior.

## How it appears in exam questions

Exam questions about routing tables fall into three main patterns: scenario-based, configuration-based, and troubleshooting-based.

Scenario-based questions present a network diagram and a set of routing tables from one or more routers. You are asked to determine which path a packet takes from source to destination. For example, a question might show a topology with three routers and list the routing table of Router A. The destination IP of the packet is given, and you must identify the next hop and outgoing interface based on the longest prefix match. This type of question tests your ability to read a routing table and apply the forwarding logic.

Configuration-based questions ask you to choose the correct command or configuration to achieve a specific routing behavior. For CCNA, this could be the correct syntax for a static route: ip route 192.168.2.0 255.255.255.0 10.1.1.2. For AWS, the question might ask which route table entry you would add to allow an instance in a private subnet to reach the internet through a NAT gateway. You would need to specify the destination as 0.0.0.0/0 and the target as the NAT gateway ID.

Troubleshooting-based questions describe a connectivity problem and ask what is most likely wrong. For example, a user in subnet A cannot reach a server in subnet B even though both are in the same VPC. The question might show the route tables for both subnets. You must notice that the route table for subnet A lacks a route for the subnet B range, or that the route points to the wrong target. Another common scenario is a host having a default gateway but traffic not reaching the internet. The question might show the host's routing table, and you must notice that the default route has the wrong next hop IP or that the metric is unusually high.

Some questions combine elements. A question might first ask you to identify the current next hop from a given routing table, then ask what command would change that next hop to a different router, and finally ask what effect that change would have on network traffic.

In cloud exams, questions often use concept terms like VPC route table, internet gateway route, or peering connection route. You must understand that a VPC route table is a logical construct and that each subnet must be explicitly associated with one. A trick question might show a route table with a correct default route but the subnet is not associated with that table, making the route ineffective.

Being comfortable with these question patterns requires both conceptual understanding and practical familiarity with how routing tables look in command output or in cloud console screenshots.

## Example scenario

A small company has a single router that connects its office network to the internet. The office network is 192.168.1.0/24. The router has two interfaces: one with IP 192.168.1.1 on the office side, and one with IP 203.0.113.1 on the internet side. The router's routing table has two entries. The first entry is for the directly connected network 192.168.1.0/24, with next hop meaning it is directly reachable via the local interface. The second entry is a default route 0.0.0.0/0 with next hop 203.0.113.2, which is the ISP's router.

A workstation in the office with IP 192.168.1.100 wants to access a website at 8.8.8.8. The workstation first checks its own routing table. It sees that 192.168.1.0/24 is directly connected, so traffic to local devices goes directly. For 8.8.8.8, it has a default route pointing to its default gateway, which is the office router at 192.168.1.1. The workstation sends the packet to the router.

The router receives the packet. It looks at the destination IP, 8.8.8.8. It checks its routing table. There is no entry for 8.8.8.0/24 or any more specific route. So the router uses the default route 0.0.0.0/0 and forwards the packet to the next hop 203.0.113.2, which is the ISP router. The packet then goes through the ISP's routing table to eventually reach 8.8.8.8.

Now imagine that the company adds a second office at 192.168.2.0/24 connected via a VPN link. The company's router now has a static route: destination 192.168.2.0/24, next hop 10.0.0.2 (the VPN peer's IP). When a workstation at the first office sends a packet to 192.168.2.50, the router receives it and looks for a match. It finds the static route with a 24-bit mask. This mask is longer than the default route's 0-bit mask, so the router chooses the static route and forwards the packet to the VPN peer, not to the internet. This scenario shows how longest prefix match and static routes work together to control where traffic goes.

## How Administrative Distance Influences Routing Table Decisions

In the context of routing tables, administrative distance (AD) is a fundamental concept that determines the trustworthiness of a routing information source. When a router receives multiple routes to the same destination network from different routing protocols, the routing table must select a single best path. Administrative distance assigns a numerical value to each routing source, with lower values indicating higher preference. For example, directly connected interfaces have an AD of 0, static routes typically have an AD of 1, Enhanced Interior Gateway Routing Protocol (EIGRP) summary routes have an AD of 5, External Border Gateway Protocol (eBGP) has an AD of 20, EIGRP internal routes have an AD of 90, Open Shortest Path First (OSPF) has an AD of 110, Routing Information Protocol (RIP) has an AD of 120, and External EIGRP has an AD of 170. When a router populates its routing table, it compares the administrative distances of all routes to the same destination. The route with the lowest AD wins and is installed in the routing table. This mechanism ensures that routing protocols with higher reliability, such as OSPF, override those with lower reliability, such as RIP, even if the latter has a better metric. Administrative distance is a Cisco-proprietary concept, though other vendors have similar mechanisms called route preference. In exam scenarios like the CCNA or Network+, questions often ask you to determine which route will be chosen based on AD values or to predict the impact of changing the AD for a static route. For example, if a router learns a route to 10.0.0.0/24 via OSPF (AD 110) and a static route to the same network with an AD of 5, the static route will be installed because it has a lower AD, regardless of the OSPF metric. Understanding administrative distance is critical for troubleshooting routing issues because a route might be missing from the routing table not due to connectivity problems but because a more preferred source is overriding it. When studying for the AWS-SAA or AZ-104, administrative distance applies to virtual routers like AWS Transit Gateway routes or Azure Route Tables, where route priority is determined similarly. The default AD for AWS route tables is 100 for static routes and lower for local routes, ensuring direct connectivity. Therefore, mastering administrative distance is essential for both on-premises and cloud routing table analysis.

## Route Selection Metrics Inside the Routing Table

The routing table does not simply store routes-it actively selects the best path to each destination using a combination of metrics. Each routing protocol defines its own metrics: RIP uses hop count, OSPF uses cost (based on bandwidth), EIGRP uses a composite metric involving bandwidth, delay, load, and reliability, and BGP uses path attributes like AS path length. When a router learns multiple routes to the same subnet from a single routing protocol, the metric values are compared, and the route with the lowest metric is installed in the routing table. For example, in OSPF, the cost is calculated as 10^8 / bandwidth in bps, so a FastEthernet link (100 Mbps) has a cost of 1, while a T1 link (1.544 Mbps) has a cost of 64. The OSPF process will choose the path with the lowest cumulative cost. In the routing table display (show ip route in Cisco), the metric value is shown after the administrative distance. For instance, "O 10.0.0.0/8 [110/65]" indicates an OSPF route with AD 110 and metric 65. In exam contexts, particularly CCNA and Network+, you must be able to interpret these values and predict which route will be selected if multiple paths exist. If the metrics are equal, the router may load balance across multiple paths, up to the maximum supported by the routing protocol (e.g., four equal-cost paths for OSPF by default). In cloud routing tables, such as those in AWS VPCs or Azure virtual networks, metric-based selection is simpler: the most specific route (longest prefix match) wins, and if multiple routes have the same prefix, the lowest metric value is chosen. AWS route tables allow you to set a metric (priority) for target gateways. For example, a VPN connection with metric 100 and a Direct Connect connection with metric 50 will result in the Direct Connect route being preferred. In exams like AWS-SAA, you might be asked why traffic is not flowing as expected despite having a route, and the answer may involve a higher-metric route being selected due to a misconfiguration. Understanding the nuances of route metrics helps you troubleshoot why a particular path is inactive or why redundant links are not being used. In Cisco routers, floating static routes (with a higher AD than a dynamic route) rely on dynamic route metrics: if the dynamic route metric becomes unreachable, the floating static route with a worse AD but a valid metric will appear in the routing table. This interplay between metrics and administrative distance is a common exam question.

## The Longest Prefix Match Rule in Routing Table Lookups

When a router receives a packet destined for a specific IP address, it consults its routing table to find the best match. The routing table uses a fundamental rule called the longest prefix match (also known as the most specific match). This means that among all routes in the table, the one with the longest subnet mask (or prefix length) that still matches the destination IP address will be used to forward the packet. For example, consider a routing table that contains three entries: a default route 0.0.0.0/0, a route to 192.168.1.0/24, and a route to 192.168.1.0/27. If a packet is destined for 192.168.1.5, it matches all three routes, but the /27 subnet (mask 255.255.255.224) is the most specific and thus will be used. If the destination is 192.168.1.200, it matches only the /24 and the default route, so the /24 route will win. If the destination does not match any specific route, the default route (if present) is used. This mechanism ensures efficient and precise routing, especially in complex networks where overlapping subnets exist. In exam environments like the CCNA, Network+, and even cloud certifications like AWS-SAA or Google ACE, questions often present a routing table and ask you to determine which route will be used for a given destination IP. You must carefully compare prefix lengths. The longest prefix match is also used in AWS route tables: a more specific route (e.g., a subnet route) overrides a less specific one (e.g., a VPC-wide route). For example, if you have a VPC with a route to 0.0.0.0/0 pointing to an internet gateway and a separate route to 10.0.0.0/16 pointing to a peering connection, traffic to 10.0.0.5 will use the peering connection because the /16 is more specific than /0. Understanding this concept is critical for troubleshooting connectivity: if a host cannot reach the internet, it might be because a more specific route (e.g., for the public IP range) is pointing to a virtual private gateway or an internal resource. In Cisco routers, the command "show ip route" displays the routing table with the prefix length included; you can see the mask in the output. For example, "S 10.0.0.0/8 [1/0] via 192.168.1.1" means a static route to 10.0.0.0/8. When forwarding packets, the router performs a binary search on the routing table based on prefix lengths. This is why routing tables are often implemented as Patricia tries or other tree structures. The longest prefix match is an essential concept for anyone designing or troubleshooting IP networks, and exam questions will test your ability to apply it correctly in scenarios with overlapping routes.

## Key Differences Between On-Premises and Cloud Routing Tables

Routing tables in traditional networking (Cisco routers, Juniper switches) and cloud environments (AWS, Azure, Google Cloud) share the same core concept-storing routes to forward packets-but differ significantly in implementation, flexibility, and management. On-premises routing tables, such as those in a Cisco router, are built dynamically via routing protocols (OSPF, EIGRP, BGP) or statically configured by an administrator. They can have hundreds of thousands of routes, support recursive lookups, and use features like route redistribution and summarization. The administrator has full control over the routing process, including modifying administrative distances and metrics. In contrast, cloud routing tables, like AWS VPC route tables, are simpler and more restrictive. They do not run dynamic routing protocols natively; instead, routes are added statically or via associated services like AWS Transit Gateway (which supports BGP), VPN connections, or Direct Connect. Each subnet in AWS must be associated with a route table, and the table contains only a limited set of destinations, primarily IPv4 or IPv6 prefixes. Cloud route tables enforce the longest prefix match rule but do not support administrative distance in the same way; instead, they use a priority system where more specific routes take precedence, and for equally specific routes, the lowest metric (if enabled) is chosen. Another major difference is that cloud routing tables are often abstracted-you do not see the entire path but only the next-hop target (e.g., an internet gateway, a NAT gateway, a peering connection). In on-premises routers, the next hop is an IP address of another router; in cloud, the next hop is a logical construct. For example, in Azure, a route table (UDR) can have routes pointing to a virtual appliance or a virtual network gateway. This abstraction simplifies management but can hide underlying complexities, such as the routing table of the underlying hypervisor. In exams like AWS-SAA, you must understand that AWS uses an implicit local route for the VPC CIDR (always highest priority) and that any custom route cannot override the local route for the VPC range. This is a frequent source of confusion: if you create a route to 10.0.0.0/16 via a peering connection, it will not be used because the local route is more specific (the exact CIDR) and has implicit higher priority. In Azure AZ-104 exams, you need to know that route tables can be applied to subnets and that system routes (like the default route to the internet) can be overridden by custom routes. In Google ACE, route tables are managed via Cloud Router and VPC networks, with dynamic routes propagated via BGP. The key takeaway is that while the fundamental principles of routing tables are universal, cloud providers simplify them to reduce operational overhead, which also introduces new failure modes. Troubleshooting cloud routing often involves checking route table associations, ensuring target gateways are healthy, and understanding that cloud routing tables do not support equal-cost multipath for all services. For example, AWS Transit Gateway supports ECMP for equal-cost BGP routes. This nuance is often tested in advanced cloud exams.

## Common mistakes

- **Mistake:** Thinking the routing table stores the entire path to the destination.
  - Why it is wrong: A routing table only stores the next hop, not the full path. Each router makes its own decision hop by hop.
  - Fix: Understand that routing is hop-by-hop. Each router only needs to know the next neighbor to send the packet to.
- **Mistake:** Assuming the router always uses the route with the lowest metric.
  - Why it is wrong: The router first uses longest prefix match. If multiple routes have the same prefix length, then it compares metrics. A route with a low metric but a short prefix loses to a more specific route with a higher metric.
  - Fix: Always check longest prefix match before metric. The most specific route wins regardless of metric.
- **Mistake:** Believing that a default route (0.0.0.0/0) is only used as a last resort and can be omitted.
  - Why it is wrong: While the default route is a last resort, many networks rely on it for internet access. Without it, traffic to unknown destinations will be dropped.
  - Fix: Always ensure a default route exists if the network needs to reach the internet or any outside network.
- **Mistake:** Confusing a routing table with a forwarding table.
  - Why it is wrong: A routing table is built by routing protocols and contains all known routes. The forwarding table is a subset that contains only the best routes and is optimized for hardware lookup. The routing table is software, the forwarding table is hardware.
  - Fix: Remember that the routing table feeds into the forwarding table. The router uses the forwarding table for actual packet forwarding at high speed.
- **Mistake:** Thinking that a directly connected network always appears with a next hop IP.
  - Why it is wrong: A directly connected network has no next hop because the destination is reachable directly on the same interface. The routing table entry marks it as directly connected or local.
  - Fix: When you see a route for a network attached to one of the router's own interfaces, there is no next hop. The interface itself is the path.
- **Mistake:** Assuming that adding a static route is enough and that the reverse route is automatic.
  - Why it is wrong: Routing is unidirectional. You must add a route on the source network's router to reach the destination, and a route on the destination network's router to send traffic back. Forgetting the reverse route is a common cause of one-way connectivity.
  - Fix: Always check both directions. A ping might fail because the return traffic has no route.
- **Mistake:** Forgetting that the routing table entry must have a next hop that is reachable.
  - Why it is wrong: If the next hop IP is not reachable by the router, the route is invalid and will not be used. The router will not forward packets to a dead next hop.
  - Fix: Ensure the next hop IP is on a directly connected network of the router. Otherwise, the router cannot send the packet there.

## Exam trap

{"trap":"When a routing table shows two routes for the same destination with different subnet masks, learners often think the one with the lower metric will always be chosen.","why_learners_choose_it":"Many study guides emphasize metrics as the tiebreaker, but learners forget that longest prefix match is checked first. They see a lower metric and assume it is automatically better.","how_to_avoid_it":"Always perform longest prefix match first. Compare the subnet masks. The route with the longer mask (more specific) is chosen, regardless of metric. Only if the masks are equal does metric come into play."}

## Commonly confused with

- **Routing table vs ARP table:** An ARP table maps IP addresses to MAC addresses on a local network segment, while a routing table maps destination networks to next hop IP addresses. ARP is used to find the physical address, routing is used to choose the next hop. They work together but are entirely different data structures. (Example: Your routing table says to send the packet to next hop 192.168.1.1. Then your ARP table tells you the MAC address of 192.168.1.1 so you can send it on the Ethernet wire.)
- **Routing table vs Forwarding table (FIB):** The routing table is the set of all routes known to the router, while the forwarding table (FIB) contains only the best routes and is used for high-speed packet forwarding in hardware. The routing table is like a library catalog, the forwarding table is a quick reference card. (Example: A router learns ten routes to the same network via OSPF. It selects the best one and puts only that one in the forwarding table. The routing table still holds all ten.)
- **Routing table vs MAC address table:** A MAC address table is used by switches to forward frames based on MAC addresses within the same broadcast domain. A routing table is used by routers to forward packets based on IP addresses across different networks. Switches do not use routing tables, and routers do not use MAC address tables for packet forwarding decisions. (Example: A switch uses its MAC table to send a frame to the correct port within your office network. Your router uses its routing table to decide whether to send that traffic to the internet or to another branch office.)
- **Routing table vs Hosts file:** A hosts file maps hostnames to IP addresses on a single computer. A routing table maps IP networks to next hops. The hosts file helps a device know which IP address corresponds to a name, while the routing table helps it know how to reach that IP address. (Example: You type www.example.com. The hosts file or DNS gives you an IP address. Then your device checks its routing table to see if it should send the packet to the default gateway or directly to the destination.)
- **Routing table vs Access control list (ACL):** An ACL is used to permit or deny traffic based on criteria like source IP, destination IP, and port. A routing table is used to determine the path traffic takes. ACLs can be applied to filter traffic that matches a route, but they do not create paths. (Example: A routing table says how to reach 10.0.0.0/8. An ACL says that traffic from 192.168.1.0/24 is not allowed to use that route. Both work together to control access and path.)

## Step-by-step breakdown

1. **Packet arrival** — A router receives a data packet on one of its interfaces. The packet contains a destination IP address in its header. This is the address the packet is trying to reach.
2. **Destination extraction** — The router reads the destination IP address from the packet header. This address is the key that will be matched against entries in the routing table.
3. **Routing table lookup** — The router searches its routing table for any entry whose destination prefix matches the packet's destination IP. Each entry in the table includes a network prefix and a subnet mask that defines the range of IPs that belong to that network.
4. **Longest prefix match determination** — If multiple entries match, the router selects the entry with the longest subnet mask. This is called the longest prefix match. It ensures the most specific route is used. For example, a /24 match is chosen over a /16 match for the same starting bits.
5. **Route selection** — If there is still more than one candidate after longest prefix match, the router compares the metrics or administrative distances of the remaining routes. The route with the lowest combined value is chosen and installed as the best route for this packet.
6. **Next hop identification** — From the chosen entry, the router reads the next hop IP address and the outgoing interface. If the entry is for a directly connected network, the next hop is essentially the destination itself, and the interface is the one connected to that network.
7. **ARP resolution (if needed)** — If the next hop is on a directly connected network, the router needs to know the MAC address of that next hop. It checks its ARP cache. If no entry exists, it sends an ARP request to find the MAC address.
8. **Packet forwarding** — The router takes the packet, changes the source and destination MAC addresses in the layer 2 header, and sends the packet out through the selected interface toward the next hop. The IP header is not modified except for the TTL, which is decremented.
9. **TTL check** — Before forwarding, the router decrements the Time To Live (TTL) field in the IP header. If the TTL reaches zero, the router discards the packet and sends an ICMP Time Exceeded message back to the source. This prevents packets from looping forever.
10. **Repeat at next router** — The next router performs the same lookup process on the packet. This continues hop by hop until the packet arrives at the device whose IP matches the destination address or until the packet is dropped for some reason.

## Practical mini-lesson

When working with routing tables in a professional setting, the most common task is understanding and configuring static routes. Static routes are simple to set up but require manual maintenance. On a Cisco router, you would enter global configuration mode and type ip route [destination_network] [subnet_mask] [next_hop_ip] or [exit_interface]. For example, ip route 10.10.20.0 255.255.255.0 192.168.1.2 creates a static route to the 10.10.20.0/24 network through the router at 192.168.1.2. The router will immediately show this route in the routing table with the code S for static.

On a Linux host, you can view the routing table using ip route show or route -n. To add a static route, you might use ip route add 10.10.20.0/24 via 192.168.1.2 dev eth0. The route remains until the interface goes down or until you delete it. In production, you would typically add this to a configuration file to survive reboots.

In cloud environments, the process is different. In AWS, you do not interact with routers directly. Instead, you create a VPC route table as a logical object, then add routes to it. A route consists of a destination CIDR block and a target, such as an internet gateway, NAT gateway, or peering connection. You then associate the route table with one or more subnets. The AWS routing infrastructure implements these routes for you.

One of the most common problems professionals face is asymmetric routing. This happens when traffic takes one path to a destination and a different path back. This can cause connectivity issues, especially with firewalls that track connection state. For example, if the forward path goes through Router A and the return path goes through Router B, and Router B has no firewall state for that connection, the return traffic may be dropped. Ensuring symmetric routing often requires careful management of routing tables and metrics.

Another practical issue is route flapping. When a link goes up and down, dynamic routing protocols recalculate routes, causing the routing table to change frequently. This can cause instability and high CPU usage. Engineers use features like route dampening to suppress flapping routes.

Finally, verifying routing tables is a daily task. The show ip route command on Cisco provides extensive information including the route's origin protocol, administrative distance, metric, next hop, and uptime. Understanding how to read this output quickly is a valuable skill. You can filter the output to see only routes learned from a specific protocol or to see routes for a specific network. Practicing with these commands in a lab environment, such as Cisco Packet Tracer or GNS3, is the best way to build confidence for exams and real-world work.

## Commands

```
show ip route
```
Displays the entire IPv4 routing table on a Cisco router, including directly connected, static, and dynamic routes. Essential for verifying which routes are installed and their administrative distance/metric.

*Exam note: Appears in CCNA and Network+ exams to test reading route entries. Often used in scenario questions to determine why a particular route is missing or which path traffic will take.*

```
ip route 192.168.2.0 255.255.255.0 10.0.0.1 10
```
Configures a floating static route to 192.168.2.0/24 with administrative distance 10 via next-hop 10.0.0.1. This route will be used only if no dynamic route with a lower AD exists.

*Exam note: CCNA exams test understanding of floating static routes: they are used for backup when the primary dynamic route fails. The AD must be higher than the dynamic protocol's default AD (e.g., 110 for OSPF).*

```
show ip route ospf
```
Filters the routing table to show only OSPF-learned routes. Useful for isolating OSPF-related issues without seeing other protocols.

*Exam note: Common in CCNA troubleshooting questions where you need to confirm if OSPF routes are being installed. Can reveal if OSPF adjacencies are working but routes are missing due to mismatched area types or cost settings.*

```
ip route 0.0.0.0 0.0.0.0 gigabitethernet0/0/1 192.168.1.1
```
Configures a default route (quad-zero) using both an exit interface and a next-hop IP. This is commonly used as a gateway of last resort for traffic to unknown destinations.

*Exam note: Default routes are tested in Network+ and CCNA as a solution for internet access. The exam may ask about the difference between specifying an interface only vs interface plus next-hop for static routes.*

```
aws ec2 describe-route-tables --filters Name=vpc-id,Values=vpc-12345678
```
Lists all route tables in an AWS VPC, including their routes and associations. Used to verify that a subnet has the correct routing for internet or VPN access.

*Exam note: In AWS-SAA, you must know how to inspect route tables programmatically. Questions may involve troubleshooting why an EC2 instance cannot access the internet even with an internet gateway, often because the subnet's route table lacks a default route to the IGW.*

```
az network route-table route list --resource-group myRG --route-table-name myRouteTable
```
Lists all routes inside an Azure route table. Critical for verifying custom user-defined routes (UDRs) that direct traffic to a firewall or virtual appliance.

*Exam note: AZ-104 exams require familiarity with Azure route tables for controlling network traffic. You might need to diagnose why traffic is not passing through a firewall, often due to incorrect route priority or missing route.*

```
show ip route 10.0.0.0 255.0.0.0 longer-prefixes
```
Displays all routes in the routing table that are subnets of the given prefix (10.0.0.0/8). Useful for examining overlapping routes and verifying the longest prefix match behavior.

*Exam note: CCNA troubleshooting: used to find more specific routes that may override a summary route. Exams test whether a packet to a specific IP will use a /24 or a /8 route.*

```
gcloud compute routes list --project myProject
```
Lists all routes in a Google Cloud VPC network, including system-generated and custom routes. Essential for understanding routing in GCP environments.

*Exam note: In Google ACE, you must be able to interpret route priority: routes with a higher priority (lower number) are preferred. The default route to the internet is often a system route with priority 1000.*

## Troubleshooting clues

- **Missing route from routing table** — symptom: A router does not have a route to a particular destination in the output of 'show ip route', causing traffic to be dropped or sent to the default route.. This happens because the routing protocol (e.g., OSPF) has not learned the route due to mismatched area configurations, passive interfaces, or ACLs blocking updates. Alternatively, the route may be present but suppressed by a lower administrative distance route. (Exam clue: CCNA exam questions often present a 'show ip route' output missing an expected route, and you must determine if the issue is a misconfigured OSPF neighbor, a missing network statement, or a route filtering policy.)
- **Flapping routes in the routing table** — symptom: Routes appear and disappear repeatedly in the routing table, causing intermittent connectivity and high CPU usage on the router.. Route flapping is typically caused by unstable physical or logical links, such as a faulty fiber optic cable, flapping BGP sessions due to misconfigured timers, or dynamic routing protocol triggered by link state changes. It can also be due to route redistribution loops. (Exam clue: Network+ and CCNA exams may describe symptoms of route flapping and ask for the most likely cause (e.g., a bad interface) or the command to verify interface stability (e.g., 'show interfaces' or 'show ip route' with timestamps).)
- **Routing table uses wrong path (suboptimal routing)** — symptom: Traffic intended for a destination takes a longer or slower path even though a better path exists in the network.. This occurs due to higher administrative distance from the preferred protocol (e.g., OSPF AD 110 vs EIGRP AD 90 if both are present), or because the metric of the best path is worse. In cloud environments, a more specific route might be pointing to a slower gateway. (Exam clue: In AWS-SAA, you may see a scenario where traffic to a subnet goes via a VPN instead of Direct Connect because the route table has a /16 route via the VPN with a lower metric than the Direct Connect route for the exact prefix.)
- **Default route missing despite configuration** — symptom: A router shows a gateway of last resort is not set, and the output of 'show ip route' does not show a 0.0.0.0/0 entry even though it was configured as a static route.. This can happen if the static default route was configured with an interface that is down or with a next-hop IP that is unreachable. The route is not installed because the outgoing interface is not up/up. If the route was redistributed from a protocol that does not match the routing table logic, it may not appear. (Exam clue: CCNA exam questions often ask why a default route is not present; the answer may involve checking the interface status with 'show ip interface brief' or verifying the next-hop reachability via 'ping'.)
- **Cloud route table not propagating to subnet** — symptom: In AWS or Azure, a subnet's traffic is not following the routes defined in a custom route table, even though the route table is associated with the subnet.. This typically occurs because a more specific system route (e.g., local VPC route) is overriding the custom route. AWS system routes for the VPC CIDR have implicit priority and cannot be overridden. In Azure, system routes for virtual network peerings may take precedence if not properly matched. (Exam clue: In AWS-SAA, a typical question: 'Why can an EC2 instance not reach the internet through a NAT gateway?' Answer: The subnet's route table has a 0.0.0.0/0 route to the NAT gateway, but the VPC's local route (for the VPC CIDR) is more specific and inadvertently hijacks traffic if the destination falls within the VPC range.)
- **Routing loops caused by routing table** — symptom: Packets traverse multiple routers repeatedly, causing TTL expiry and connectivity failure. The routing table shows a route pointing back to the router that forwarded the packet.. This occurs when two routers each have a default route pointing to each other (e.g., Router A's 0.0.0.0/0 via Router B, and Router B's 0.0.0.0/0 via Router A). In dynamic routing, loops can arise from incorrect route redistribution or lack of split horizon. (Exam clue: CCNA and Network+ exams often present a topology with static routes causing a loop; you must identify the misconfiguration (e.g., both routers using each other as next-hop) and suggest removing one of the default routes.)
- **Subnet not reachable due to missing route in transit gateway** — symptom: In a multi-VPC setup with AWS Transit Gateway, an EC2 instance cannot reach a resource in another VPC even though the route tables are associated.. This happens when the Transit Gateway route table does not have a route for the destination subnet, or the route is pointing to a VPC attachment that is not properly propagated. Also, security group or NACL rules may be blocking, but the routing table is the first suspect. (Exam clue: AWS-SAA exam: A scenario where VPCs are connected via Transit Gateway but traffic fails. The answer often involves checking that the Transit Gateway route table contains the required static or propagated routes for each VPC attachment.)

## Memory tip

Remember the order: Longest Prefix Match first, then Metric. LPM wins every time. Think of LPM as the most specific answer on a multiple-choice test.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/routing-table