Exam Objective 3.1: Interpret a routing table to identify the next hop for a packet (routing protocol, prefix/mask, administrative distance, metric, and default route).
Everything routing-related on the exam eventually comes back to one core skill: given a routing table and a destination IP address, correctly identify which entry the router will actually use and what the next hop will be. This objective is purely about reading and interpreting show ip route output correctly — no configuration is required, just fluent understanding of every field in a routing table entry and the rules a router follows to pick a route.
A routing table is the list of known destination networks a router maintains, along with the information needed to forward a packet toward each one. Routes can be learned from several different sources simultaneously — directly connected networks, statically configured routes, and dynamic routing protocols — and the router needs a consistent, deterministic method for choosing which route to actually use when multiple entries could apply to the same packet.
Command to view it: show ip route
A typical routing table line looks like this:
O 192.168.20.0/24 [110/20] via 10.1.1.2, 00:15:42, GigabitEthernet0/1
Breaking this down field by field:
Routing protocol code (the leading letter or letters): Identifies the source that installed this route. Common codes:
C — directly connected network
L — local route (a /32 host route automatically created for the router's own interface address, distinct from the C connected route for the whole subnet)
S — static route, manually configured by an administrator
S* — a static route that is also flagged as a candidate default route
O — OSPF-learned route
D — EIGRP-learned route (legacy code, retained from EIGRP's earlier name)
R — RIP-learned route
B — BGP-learned route
OE2 / OIA, etc. — variations indicating OSPF route sub-types (external, inter-area) and whether the route is a candidate default
Prefix/mask (192.168.20.0/24): The destination network and its associated prefix length, defining exactly which range of destination addresses this route entry applies to.
Administrative distance and metric, in brackets ([110/20]): Two separate numbers packed into one bracketed field.
The first number (110 in this example) is the administrative distance (AD) — a measure of how trustworthy this particular routing source is considered to be.
The second number (20 in this example) is the metric — a measure of how "good" (typically how costly/far) this specific path is, calculated according to whatever routing protocol installed the route.
Next-hop address (via 10.1.1.2): The IP address of the next router the packet should be forwarded to in order to continue toward the destination network. A directly connected route will not show a "via" next-hop address at all, since no further router hop is needed — the destination is directly attached.
Timer (00:15:42): How long this route has been in the routing table since it was last learned/refreshed, relevant mainly for dynamic routing protocols; static and connected routes don't display a meaningful aging timer in the same way.
Exit interface (GigabitEthernet0/1): The local interface the router will actually send the packet out of to reach the next hop.
Exam Alert: Expect to be shown a full routing table entry and asked to identify one specific field — most commonly the next-hop address or the administrative distance — so practice reading every field of a sample entry, not just recognizing the overall route.
Administrative distance is a value (0–255) representing how trustworthy a particular routing information source is considered by Cisco IOS. When a router learns about the exact same destination network from two different sources (for example, both a static route and OSPF claim to know how to reach 192.168.20.0/24), the router installs only the route from the source with the lower (more trusted) administrative distance into the active routing table — the other source's route is simply not used, even though it may still exist in that protocol's own internal database.
Default administrative distances to memorize:
Connected interface — 0
Static route — 1
EIGRP (internal) — 90
OSPF — 110
IS-IS — 115
RIP — 120
EIGRP (external) — 170
Unknown/unreachable (explicitly untrusted) — 255, meaning this source is never used
Key principle — lower AD wins: A route with AD 90 (EIGRP) will always be preferred over a route to the same destination with AD 110 (OSPF), regardless of either route's metric — administrative distance is checked first, before metric ever becomes relevant. Metric is only used to choose between multiple routes from the same source (or, in the case of equal-AD tie scenarios, as an additional tiebreaker within that same routing protocol).
Exam Alert: The specific default AD values (0 for connected, 1 for static, 90 for EIGRP, 110 for OSPF, 120 for RIP) are extremely likely to appear directly on the exam, either as a fact to recall or embedded in a scenario where you must determine which of two competing routes to the same destination will actually be installed.
Metric is the value a specific routing protocol uses to measure and compare the relative "cost" or desirability of different possible paths to the same destination, when multiple paths are known through that same protocol. Unlike administrative distance (which is standardized across protocols by Cisco), each routing protocol calculates its own metric using entirely different criteria:
RIP — hop count (number of routers a packet must cross); lower is better; maximum of 15 hops before a route is considered unreachable
OSPF — cost, derived from cumulative interface bandwidth along the path (lower cost = higher bandwidth = better path)
EIGRP — a composite metric primarily driven by bandwidth and delay along the path (by default), producing a large numeric value that is not directly comparable across protocols
Static routes — no calculated metric in the traditional sense; typically shown with a metric of 0, since there's only ever one path per static route entry by definition
Metric is only relevant among routes from the same protocol: Metric is never used to compare a route learned via OSPF against a route learned via EIGRP — that comparison is decided entirely by administrative distance instead. Metric only comes into play when a router has multiple possible paths to the same destination all learned via the same routing protocol, in which case the path with the better (typically lower) metric is preferred.
Exam Alert: Know that AD is compared first (across different sources), and metric is compared second (only within routes from the same source/protocol). This two-step decision process is one of the most frequently and directly tested concepts in this objective.
Before AD and metric even become relevant, a router's very first step in forwarding any packet is to find every routing table entry whose prefix could match the packet's destination address, and then choose the most specific matching entry — the one with the longest prefix length (the highest subnet mask/CIDR number).
Worked example: A router's table contains both 192.168.20.0/24 and 192.168.20.0/26. A packet destined for 192.168.20.40 technically falls within both ranges. The router will use the /26 route, not the /24 route, because /26 is more specific (a longer prefix) — even if the /24 route happens to have a better administrative distance or metric. Longest prefix match is always evaluated first and always wins, regardless of AD or metric.
Why this matters for real troubleshooting: A common real-world (and exam) scenario involves a router having both a broad summary route (like a default route, 0.0.0.0/0) and a specific route to a subset of that same address space; the router will always prefer the more specific route for any packet whose destination falls within both, using the broader/default route only for destinations that don't match any more specific entry at all.
Exam Alert: Longest prefix match takes priority over administrative distance and metric entirely — this ordering (longest match first, then AD, then metric) is a frequently tested sequence, and getting the order backwards is a common mistake under exam time pressure.
A default route (0.0.0.0/0) is a special routing table entry matching any destination address not more specifically matched by any other entry in the table — it exists as a catch-all path for traffic destined anywhere the router doesn't have more precise routing information for.
Static default route configuration example:
ip route 0.0.0.0 0.0.0.0 203.0.113.1
Gateway of last resort: When a default route is present in the routing table, show ip route displays a specific line near the top of the output identifying it directly:
Gateway of last resort is 203.0.113.1 to network 0.0.0.0
This line is simply a convenient, explicit summary of whichever route is currently serving as the default route — it is not a separate mechanism, just a clearly labeled pointer to the 0.0.0.0/0 entry (or whichever route has been designated as a candidate default, marked with an asterisk in its protocol code, such as S* or O*E2) currently installed.
If no default route/gateway of last resort exists: Any packet destined for a network with no matching entry anywhere in the routing table (not even a default route) is simply dropped, and the router typically generates an ICMP "destination unreachable" message back toward the original source.
Exam Alert: Recognize that "Gateway of last resort" in show ip route output is directly pointing at the currently active default route — you may be asked to identify the gateway of last resort's IP address directly from sample output, or to explain what happens to traffic when no default route/gateway of last resort exists at all (it gets dropped).
Longest prefix match — among all routing table entries whose prefix range includes the packet's destination address, select the entry with the longest (most specific) prefix length.
If multiple routing sources offered a route to that exact same most-specific prefix, administrative distance decides which source's route is actually installed and used — lower AD wins.
If multiple paths to that same prefix were learned via the same routing protocol/source, metric decides between them — the better (typically lowest) metric wins.
If two routes are tied in prefix length, AD, and metric, most modern Cisco platforms support equal-cost load balancing across all tied paths, forwarding traffic across both (or all) equally-good routes rather than arbitrarily picking just one.
If no matching entry exists at all, the router checks for a default route (gateway of last resort) as a final catch-all; if that's also absent, the packet is dropped.
Same destination, different sources, different AD: A table shows both S 192.168.30.0/24 [1/0] via 10.1.1.1 and O 192.168.30.0/24 [110/30] via 10.1.1.2. Since both entries have the exact same prefix length, AD decides — the static route (AD 1) wins over the OSPF route (AD 110), and only the static route appears as the active installed route in show ip route (the OSPF route is suppressed even though OSPF itself still knows about that path internally).
Same destination, same source, different metric: Two OSPF-learned paths exist to the same exact prefix, one with a cost of 20 and one with a cost of 30. Since both share the same AD (both are OSPF), metric breaks the tie — the path with cost 20 is preferred and installed.
Overlapping prefixes of different lengths: A table contains both a /24 and a more specific /28 covering part of that same /24's range. Any packet whose destination falls within the /28's specific range uses the /28 entry, regardless of what routing source or AD/metric either entry has — longest prefix match is evaluated before AD/metric ever come into consideration.
Exam Alert: These three scenario patterns (same prefix/different AD, same prefix/same protocol different metric, overlapping prefixes of different lengths) essentially cover the full range of "which route wins" questions you're likely to see — practice identifying which of the three situations a given sample routing table represents before applying the correct rule.
Q1. A routing table contains a static route and an OSPF-learned route, both to the exact same destination prefix 172.16.5.0/24. Which route will be installed in the active routing table?
A. The OSPF route, because it has a higher metric
B. The static route, because it has a lower administrative distance
C. Both routes will be installed and load-balanced automatically
D. Neither route will be installed since there is a conflict
Answer: B. Static routes have a default administrative distance of 1, while OSPF has a default administrative distance of 110. Since both routes cover the exact same prefix length, administrative distance decides which one is installed — the lower AD (the static route) wins, and the OSPF route to that same prefix is not installed in the active table even though OSPF itself may still be aware of that path internally.
Q2. A router's table contains both 10.0.0.0/8 and 10.1.1.0/24. A packet is destined for 10.1.1.50. Which route will the router use?
A. 10.0.0.0/8, because it was learned first
B. 10.1.1.0/24, because it is the more specific (longest prefix) match
C. Whichever route has the lower administrative distance
D. Whichever route has the lower metric
Answer: B. Longest prefix match is evaluated before administrative distance or metric are ever considered. Since 10.1.1.50 falls within both ranges, the router selects the more specific /24 entry over the broader /8 entry, regardless of which routing source installed either route or what their respective AD/metric values might be.
Q3. Which of the following correctly lists default administrative distances from most trusted (lowest) to least trusted (highest)?
A. OSPF, EIGRP, Static, Connected
B. Connected, Static, EIGRP, OSPF
C. RIP, OSPF, EIGRP, Static
D. Static, Connected, OSPF, EIGRP
Answer: B. The correct order from most trusted to least trusted is Connected (0), Static (1), EIGRP internal (90), OSPF (110). Lower administrative distance values indicate a more trusted source, with directly connected interfaces always being the most trusted, and dynamically learned protocol routes generally being less trusted than manually configured static routes.
Q4. In the show ip route output line "O 192.168.40.0/24 [110/45] via 10.2.2.2, 00:08:15, GigabitEthernet0/2", what does the number 45 represent?
A. The administrative distance
B. The OSPF cost (metric) for this path
C. The number of hops to the destination
D. The VLAN ID of the exit interface
Answer: B. In the bracketed [AD/metric] notation, the first number (110) is the administrative distance associated with OSPF-learned routes, and the second number (45) is the metric — specifically OSPF cost in this case, representing the cumulative bandwidth-based cost of the path to that destination.
Q5. A router's routing table has no specific route matching a packet's destination network, but it does have a route showing 0.0.0.0/0 via 203.0.113.1, with "Gateway of last resort is 203.0.113.1 to network 0.0.0.0" displayed at the top of show ip route output. What happens to the packet?
A. The packet is immediately dropped, since no specific route exists
B. The packet is forwarded to 203.0.113.1, using the default route as a catch-all
C. The router broadcasts the packet out every interface
D. The packet is held indefinitely until a more specific route is learned
Answer: B. When no more specific route matches a packet's destination, the router falls back to the default route (0.0.0.0/0) if one is present, forwarding the packet to the gateway of last resort. Only if no default route existed at all would the packet be dropped, typically triggering an ICMP destination unreachable message back to the source.
Q6. Two OSPF-learned routes exist in a routing table to the same exact destination prefix, one with a cost of 15 and one with a cost of 25. Assuming both have the identical administrative distance, which route is preferred?
A. The route with cost 25, since OSPF prefers higher metrics
B. The route with cost 15, since a lower OSPF cost indicates a better (higher-bandwidth) path
C. Both routes are automatically discarded due to the conflict
D. The route learned most recently is always preferred regardless of cost
Answer: B. Since both routes share the same administrative distance (both are OSPF), the router uses metric as the tiebreaker. OSPF cost is inversely related to path quality — a lower cost reflects a cumulative higher-bandwidth path — so the route with the lower cost value (15) is preferred and installed as the active route.