How a Router Makes a Forwarding Decision

What it is

A router compares a packet's destination address with its routing table and picks one matching route.

Often several entries match, and the router must choose one. The choice follows a fixed order of tie-breakers, and learning that order is the key to answering most routing table questions.

How it works

The router applies three rules in a fixed order, and each rule is used only when the one before it leaves a tie.

The three rules, in order

Step 1: longest prefix match

A route matches a destination if the destination falls inside the route's network.

The longest prefix is the match with the most bits, which means the most specific route. This rule always wins first.

Suppose the destination is 10.1.1.5 and the table contains:

• 10.0.0.0/8
• 10.1.0.0/16
• 10.1.1.0/24
• 0.0.0.0/0

All four match. The /24 is the longest, so the router uses it. A default route 0.0.0.0/0 matches everything, and since it has a length of zero it is always the last choice.

This rule ignores administrative distance and metric. A /24 route with a poor metric still beats a /16 route with an excellent metric, because specificity is checked first.

Step 2: administrative distance

If two routes have exactly the same prefix and mask, learned from different sources, the one with the lower administrative distance wins.

For example, 192.168.5.0/24 may be known by OSPF (AD 110) and by a static route (AD 1). The router installs the static route. The OSPF route is held back as a backup, and it appears in the table only if the static route disappears.

AD only breaks a tie between routes with the same prefix length. It does not override a longer prefix.

Step 3: metric

If the same protocol offers several routes to the same prefix, the lowest metric wins. For OSPF, this means the lowest total cost.

If two routes from the same protocol have the same metric, the router can use both. This is called equal-cost load balancing, and the traffic is shared between the paths.

The number of equal-cost paths a router will use is limited. For OSPF and EIGRP, the default is four, and it can be changed with the maximum-paths command.

Putting it together

Consider these two entries.

S    192.168.5.0/24 [1/0] via 10.1.1.2
O    192.168.5.0/25 [110/20] via 10.1.2.2

A packet for 192.168.5.10 matches both entries, because the /25 covers addresses .0 to .127 and the /24 covers all of them. The /25 is longer, so it is chosen, even though the static route has a lower AD.

A packet for 192.168.5.200 matches only the /24 and goes through the static route.

What the router does next

Once the route is chosen, the router finds the outgoing interface and next hop.

1. It looks up the next hop's MAC address, using ARP on an Ethernet link.
2. It rewrites the Layer 2 frame header, with its own MAC address as the source and the next hop's as the destination.
3. It decreases the TTL by one.
4. If the TTL reaches zero, the packet is dropped and an ICMP message goes back to the sender.

If no route matches and there is no default route, the router drops the packet and sends an ICMP destination unreachable message.

Checking the decision

One command shows the route a destination would use.

show ip route 192.168.5.10

This displays the specific route that the router would use for that destination, and how it was learned. It is a quick way to test your own reasoning.