Routelearn.net
Course menu

Course 8: RoutingLesson 1.2 (1 of 12 in this course)50 of 91 in the CCNA series

Reading the routing table

Route codes, connected and local routes, and what each part of a route line means.

Beginner · 8 min read

The routing table is the list of routes a router uses to forward packets. Each route names a destination network and prefix length, the source it came from (connected, local, static or a routing protocol), and the next-hop address or exit interface to use.

In simple terms: It is the router’s list of networks it knows how to reach, with directions for each one: “for this network, send the packet that way.”

A real-life situation

Users on PC1 say they can reach the internet but not the branch server. Before you change anything, you log in to R1 and look at its routing table. If you can read it quickly, you will usually spot the problem in seconds.

What the routing table is

The routing table is the router's list of every network it knows how to reach. Each line, called a route, says: "to reach this network, send the packet to this next hop, out of this interface". Routes come from three sources:

  • Connected: networks on the router's own interfaces. Added automatically when an interface is up and has an IP address.
  • Static: routes an administrator types in by hand.
  • Dynamic: routes learned from other routers through a routing protocol such as OSPF.
192.168.1.0/24203.0.113.0/3010.0.12.0/3010.0.23.0/30192.168.2.0/24192.168.3.0/24PC1192.168.1.10ISP203.0.113.1R1R2R3PC2192.168.2.10Server192.168.3.10
  1. 1. Connected and local: R1's three working interfaces give it three connected networks and three local /32 routes, with no configuration beyond the IP addresses.
  2. 2. Static: R1 can't see the LANs behind R2 and R3. An administrator adds routes for 192.168.2.0/24 and 192.168.3.0/24 via 10.0.12.2.
  3. 3. Static default: everything else goes to the ISP at 203.0.113.1. The * marks it as the candidate default route.

Read R1's table

Here is R1's table. The long legend at the top is trimmed. This output is based on Cisco documentation, not run on a lab device.

Example output · based on Cisco documentation; exact format varies by platform and software version
R1#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       * - candidate default, U - per-user static route
       ...

Gateway of last resort is 203.0.113.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 203.0.113.1
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.0.12.0/30 is directly connected, GigabitEthernet0/1
L        10.0.12.1/32 is directly connected, GigabitEthernet0/1
      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/24 is directly connected, GigabitEthernet0/0
L        192.168.1.1/32 is directly connected, GigabitEthernet0/0
S     192.168.2.0/24 [1/0] via 10.0.12.2
S     192.168.3.0/24 [1/0] via 10.0.12.2
      203.0.113.0/24 is variably subnetted, 2 subnets, 2 masks
C        203.0.113.0/30 is directly connected, GigabitEthernet0/2
L        203.0.113.2/32 is directly connected, GigabitEthernet0/2
The indented lines with no code ("is variably subnetted") are just headings. They group subnets of the same classful network and are not routes themselves.

The parts of one route line

Take this line apart: S 192.168.3.0/24 [1/0] via 10.0.12.2

PartValueMeaning
CodeSHow the route was learned: static
Prefix192.168.3.0/24The destination network and its length
[AD/metric][1/0]Administrative distance 1 (trust in the source), metric 0 (cost of the path). The “Administrative distance and metric” lesson explains both
Next hopvia 10.0.12.2The neighbour to send the packet to: R2
Exit interface(found from the next hop)10.0.12.2 is in connected route 10.0.12.0/30, so the packet leaves Gi0/1

A route learned by a protocol also shows its age and exit interface, for example O 192.168.3.0/24 [110/3] via 10.0.12.2, 00:05:12, GigabitEthernet0/1.

Why connected and local routes both exist

The connected route (C) covers the whole subnet on the interface, like 192.168.1.0/24. It tells R1 that any address in that range can be reached directly, with no next hop.

The local route (L) is a /32 for the router's own address on that interface, like 192.168.1.1/32. A /32 matches exactly one address. It tells R1: "packets for this address are for me, don't forward them". That is how R1 knows to answer a ping or an SSH login aimed at itself.

If an interface goes down, its C and L routes disappear from the table, and so do any static routes whose next hop was only reachable through it.

Useful variations

show ip route 192.168.3.10

Shows the single route R1 would use for this address, with its source, distance and next hop.

show ip route static

Lists only static routes. Swap in connected or ospf to filter by source.

show ip route | include ^S|^C

A quick filter when the table is long.

Check yourself

Predict · scenario 1

What does the code L mean on 10.0.12.1/32?

Predict · scenario 2

In [1/0], what is the 1?

Predict · scenario 3

You remove the IP address from Gi0/0 on R1. What happens to 192.168.1.0/24 in the table?