{"id":169329,"date":"2026-06-21T12:00:53","date_gmt":"2026-06-21T09:00:53","guid":{"rendered":"https:\/\/computingforgeeks.com\/?p=169329"},"modified":"2026-06-21T12:00:53","modified_gmt":"2026-06-21T09:00:53","slug":"cisco-ip-routing-table-explained","status":"publish","type":"post","link":"https:\/\/computingforgeeks.com\/cisco-ip-routing-table-explained\/","title":{"rendered":"How to Read the Cisco IP Routing Table (show ip route)"},"content":{"rendered":"

A router makes one decision over and over, millions of times a second: which way to send this packet. The routing table is how it decides, and show ip route<\/code> is how you read that decision for yourself. Every routing topic that follows, static routes<\/a>, OSPF, troubleshooting, comes back to this one screen, so reading it fluently is the single most useful skill in the whole IP Connectivity domain.<\/p>\n\n

This breaks down a real Cisco routing table line by line: the source codes, the numbers in brackets, why one route beats another, and how the router actually picks a path for a packet. If the routing protocols themselves are still hazy, the IP routing and routing protocols overview<\/a> covers those; here the focus is the table. Captured on Cisco IOS 15.2 in June 2026, on two c7200 routers in GNS3.<\/em><\/p>\n\n

What the routing table holds<\/h2>\n\n

The table is built from three kinds of routes: networks the router is directly connected to, static routes you type in, and routes learned from a dynamic protocol like OSPF. Each line starts with a one or two letter code naming its source. The legend prints at the top of every show ip route<\/code>, and the codes that matter for the CCNA are a short list: C<\/code> connected, L<\/code> local, S<\/code> static, and O<\/code> for OSPF.<\/p>\n\n

The lab behind this is two routers<\/a>, R1 and R2, joined by a \/30 and running OSPF in area 0. Each has a couple of loopbacks, and R1 also carries a static route and a default route, so its table shows every CCNA code at once.<\/p>\n\n\n

\"R1<\/figure>\n\n\n

That topology was built and captured on two c7200 routers in GNS3:<\/p>\n\n\n

\"GNS3<\/figure>\n\n\n

Here are the route codes you will actually meet, with what each one means:<\/p>\n\n\n

\n
Code<\/th>Source<\/th><\/tr><\/thead>
C<\/td>Directly connected network (an up\/up interface with an IP)<\/td><\/tr>\n
L<\/td>Local: the \/32 host route for the router’s own interface address<\/td><\/tr>\n
S<\/td>Static route you configured<\/td><\/tr>\n
O<\/td>Learned from OSPF (D is EIGRP, R is RIP, B is BGP)<\/td><\/tr>\n
S*<\/td>A static default route, the candidate default<\/td><\/tr>\n<\/tbody><\/table><\/figure>\n\n\n

Reading a single route line<\/h2>\n\n

Run the command on R1 and the whole table prints under the legend:<\/p>\n\n\n

show ip route<\/code><\/pre>\n\n\n
Every code from the table above shows up in the real output:<\/p>\n\n\n
\"show<\/figure>\n\n\n
Take one line: O 192.168.20.0\/24 [110\/2] via 10.0.12.2, 00:00:09, GigabitEthernet0\/0<\/code>. Read it left to right. O<\/code> is the source: OSPF learned it. 192.168.20.0\/24<\/code> is the destination network and its prefix length. The bracket [110\/2]<\/code> is the part people misread, so it is worth committing to memory: it is always [administrative distance \/ metric]<\/strong>. So 110 is the administrative distance (OSPF’s default) and 2 is the OSPF metric. After via<\/code> comes the next-hop address, then how long the route has been in the table, then the interface the router will send the packet out of.<\/p>\n\n
Administrative distance: which source wins<\/h2>\n\n
Administrative distance answers a single question: when two different sources offer a route to the same network, which one does the router believe? Lower is more trusted. A directly connected network (AD 0) always beats a static (1), which beats OSPF (110), which beats RIP (120). The router installs only the winner in the table.<\/p>\n\n\n
\n
Route source<\/th>Default administrative distance<\/th><\/tr><\/thead>
Connected<\/td>0<\/td><\/tr>\n
Static<\/td>1<\/td><\/tr>\n
External BGP (eBGP)<\/td>20<\/td><\/tr>\n
EIGRP (internal)<\/td>90<\/td><\/tr>\n
OSPF<\/td>110<\/td><\/tr>\n
RIP<\/td>120<\/td><\/tr>\n
Internal BGP (iBGP)<\/td>200<\/td><\/tr>\n
Unusable<\/td>255<\/td><\/tr>\n<\/tbody><\/table><\/figure>\n\n\n
This is why the static route to 203.0.113.0\/24 in the lab sits in the table as an S<\/code> with AD 1. If OSPF later learned the same prefix, the static would still win on its lower distance.<\/p>\n\n
Metric: which route within a protocol<\/h2>\n\n
Administrative distance only compares different sources. When a single protocol knows two routes to the same network, AD is identical, so the tie breaks on the metric, the protocol’s own measure of cost. Lower wins. OSPF derives its metric from bandwidth (it calls it cost), EIGRP uses a bandwidth-and-delay composite, and RIP just counts hops. In the bracket [110\/2]<\/code>, the 2 is that OSPF cost.<\/p>\n\n
Longest-prefix match: how the router actually forwards<\/h2>\n\n
Here is the part that trips people up, because it is a different rule from the two above. Administrative distance and metric decide which route to install<\/em> for a given prefix. But when an actual packet arrives, the router chooses among the installed routes by longest-prefix match<\/strong>: the most specific route that matches the destination wins, regardless of AD or metric.<\/p>\n\n
If the table holds both 192.168.20.0\/24<\/code> and a default 0.0.0.0\/0<\/code>, a packet to 192.168.20.5 follows the \/24, because \/24 is a longer (more specific) match than \/0. The default route is the loosest possible match, so it only catches packets that nothing more specific does. Order of operations: longest-prefix match first to choose among different prefixes, then lowest AD and lowest metric only to settle competing routes to the same<\/em> prefix.<\/p>\n\n
The gateway of last resort<\/h2>\n\n
At the top of the lab table is the line Gateway of last resort is 10.0.12.2 to network 0.0.0.0<\/code>, paired with an S* 0.0.0.0\/0 [1\/0] via 10.0.12.2<\/code> entry. That is the default route. It matches any destination, but as the loosest possible prefix it is used only when no specific route fits. Most edge routers point a default at the next hop toward the internet, so anything not in the table heads that way instead of being dropped.<\/p>\n\n
Inspecting one route<\/h2>\n\n
The table is the summary. To see everything the router knows about one destination, add the prefix to the command:<\/p>\n\n\n
show ip route 192.168.20.0<\/code><\/pre>\n\n\n
That expands into the full record for the route, including the source, the distance and metric, and where it was learned:<\/p>\n\n\n
\"show<\/figure>\n\n\n
The detail spells out what the one-line entry compresses: Known via \"ospf 1\", distance 110, metric 2, type intra area<\/code>, and the descriptor block naming the next hop and exit interface. When a route is in the table but traffic still fails, this is the command that shows you whether the router learned it the way you expected. The neighbor output below confirms the OSPF adjacency that fed it is fully up.<\/p>\n\n
Practice the Cisco routing table<\/h2>\n\n
The two-router OSPF lab is paste-ready for GNS3, Cisco Packet Tracer, or real gear in the companion repo: c4geeks\/ccna-labs<\/a>. Build R1 and R2, paste the configs, and show ip route<\/code> fills in exactly as above. It assumes the routers already have their base configuration<\/a> and IP addressing in place; if subnets and masks are shaky, review IPv4 addressing<\/a> first. The routing table is the foundation of the IP Connectivity domain on the CCNA 200-301 study roadmap<\/a>.<\/p>\n\n
Test the codes, the distance-versus-metric distinction, and longest-prefix match with the quiz:<\/p>\n\n
Loading quiz...<\/div><\/div>\n\n\n
Then drill the route codes and the administrative distance values with the flashcards, or load the deck into Anki:<\/p>\n\n
Loading flashcards...<\/div><\/div>\n\n\n
Three ways the routing table trips people up<\/h2>\n\n
Most routing-table mistakes come from confusing the three selection rules. Keep them straight:<\/p>\n\n\n
    \n
  • Reading the bracket backwards.<\/strong> [110\/2]<\/code> is [AD\/metric], not [metric\/AD]. The first number is always the administrative distance.<\/li>\n
  • Thinking the lowest AD forwards the packet.<\/strong> AD and metric only decide which route gets installed<\/em> for a prefix. The packet itself follows longest-prefix match, so a \/24 with a high metric still beats a \/0 default.<\/li>\n
  • Expecting an OSPF loopback to appear with its real mask.<\/strong> OSPF advertises loopbacks as \/32 host routes by default. The lab sets ip ospf network point-to-point<\/code> on the loopback so 192.168.20.0 shows up as the \/24 you configured.<\/li>\n<\/ul>\n\n\n
    Get those three straight and show ip route<\/code> stops being a wall of text. It becomes the first place you look, on every routing problem you will ever troubleshoot.<\/p>\n","protected":false},"excerpt":{"rendered":"
    Read the Cisco IP routing table with show ip route: route codes, administrative distance vs metric, longest-prefix match, and the gateway of last resort.<\/p>\n","protected":false},"author":3,"featured_media":169328,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[299,55],"tags":[524,525],"cfg_series":[39888],"class_list":["post-169329","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-how-to","category-networking","tag-ccna","tag-cisco","cfg_series-ccna-200-301"],"_links":{"self":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts\/169329","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/comments?post=169329"}],"version-history":[{"count":1,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts\/169329\/revisions"}],"predecessor-version":[{"id":169344,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts\/169329\/revisions\/169344"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/media\/169328"}],"wp:attachment":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/media?parent=169329"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/categories?post=169329"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/tags?post=169329"},{"taxonomy":"cfg_series","embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/cfg_series?post=169329"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}