How to Read a Cisco Routing Table Like A Pro: The Complete CCNA Beginner's Guide

Introduction

Have you ever typed show ip route on a Cisco router and felt completely lost?

You see something like this:

..

Gateway of last resort is 192.168.1.1 to network 0.0.0.0

C    192.168.1.0/24 is directly connected, GigabitEthernet0/0
L    192.168.1.1/32 is directly connected, GigabitEthernet0/0
S    10.0.0.0/8 [1/0] via 192.168.1.2
O    172.16.0.0/16 [110/2] via 192.168.1.3, 00:01:23, GigabitEthernet0/1

Your brain freezes. What do all these letters mean? What is [1/0]? Why does one route have [110/2]? Why do I see both C and L routes?

If this sounds familiar, you are not alone. Most CCNA students can configure routing protocols but cannot read a routing table properly. And that is a problem because troubleshooting networks requires understanding what the routing table is telling you.

In this guide, I will break down every part of a Cisco routing table. By the end, you will be able to read any routing table and understand exactly what is happening in your network.

📌 New to CCNA? Start with Why Most Beginners Fail CCNA and OSI Model vs TCP/IP.

Why the Routing Table Confuses Almost Every CCNA Student

Most CCNA students struggle with routing tables because they only focus on configuration and ignore the output. They memorize commands but never learn how to interpret what the router is telling them.

The routing table is the single most important troubleshooting tool on a router. It tells you exactly what the router knows about the network and how it will forward traffic. If you cannot read it, you cannot troubleshoot.

The problem is that most courses explain routing tables as a list of concepts to memorize rather than a practical tool to use. They tell you what AD and metric mean but never show you how to use them to solve real problems.

This guide takes a different approach. We will look at routing tables the way a network engineer does — as a diagnostic tool that tells a story about your network.

📌 Related: Read Subnetting Made Easy and Wildcard Mask Explained.

What a Cisco Router Actually Does When a Packet Arrives

When a packet arrives on any interface, the router reads the destination IP address, looks it up in the routing table, and forwards the packet out the interface that leads toward the best matching route. If no match is found and no default route exists, the packet is dropped.

This lookup happens millions of times per second in production networks. The routing table is the data structure the router uses to decide where to forward every IP packet it receives.

Every router makes forwarding decisions based on its routing table. Without it, the router would not know where to send packets. The routing table is populated by directly connected networks, local host routes, static routes, dynamic routes, and default routes.

Running Your First show ip route

The show ip route command (run from privileged EXEC mode) displays the complete IPv4 routing table — every known network prefix, its source, its administrative distance and metric, the next-hop address, the route age, and the exit interface. Knowing how to read every element of this output is one of the most fundamental CCNA skills.

Cisco Systems provides official documentation for the show ip route command. According to Cisco's command reference, this EXEC command displays the current state of the routing table. The command has been available since Cisco IOS Release 10.0 and remains the primary tool for examining routing information on Cisco devices. Network administrators use this command to verify routing protocol convergence and troubleshoot connectivity issues.

Cisco Command Reference: show ip route

When does a router add an entry to the routing table? 

• Connected route (C) → when an interface is configured with an IP and is up/up

• Local route (L) → automatically added alongside each C route (/32 host route)

• Static route (S) → when admin enters "ip route" command

• Dynamic route (O/D/R) → when a routing protocol learns the prefix from a neighbor

When does a route disappear? 

• Interface goes down → connected route removed instantly

• Static route deleted → "no ip route ..." command

• Dynamic route lost → neighbor adjacency drops; route times out

Reading One Route Like a Network Engineer

Let us look at a real routing table entry and break it down piece by piece.

..

O       10.1.1.0/24 [110/20] via 192.168.1.2, 00:05:43, GigabitEthernet0/1
│       │            │   │         │            │           │
│       │            │   │         │            │           └─ Exit interface
│       │            │   │         │            └─ Route age (hh:mm:ss since last update)
│       │            │   │         └─ Next-hop IP address
│       │            │   └─ Metric (OSPF cost = 20 for this path)
│       │            └─ Administrative Distance = 110 (OSPF)
│       └─ Destination network / prefix length
└─ O = OSPF intra-area route

Route Code (O): Tells you how the router learned about the route. Common codes include C (Connected), L (Local), S (Static), O (OSPF), D (EIGRP), R (RIP), and B (BGP).

Destination Network (10.1.1.0/24): The network address and prefix length. The router knows about this network and can forward packets to it.

Administrative Distance [110]: A number that represents the trustworthiness of the route source. Lower numbers are more trusted. Connected routes have AD 0, static routes AD 1, EIGRP AD 90, OSPF AD 110, and RIP AD 120.

Metric [20]: A number that represents the cost of the route. Different routing protocols use different metrics. OSPF uses cost based on bandwidth, EIGRP uses a composite metric, and RIP uses hop count.

Next-Hop (via 192.168.1.2): The IP address of the next router that will receive the packet.

Route Age (00:05:43): How long the route has been in the routing table.

Exit Interface (GigabitEthernet0/1): Which interface the router will use to send the packet.

Why Cisco Chooses One Route Over Another

Routers follow a specific order when selecting the best route. This is called the route selection process.

Step 1: Longest Prefix Match

The router looks at all routes that match the destination IP. It chooses the one with the longest prefix length.

Example: If the destination is 192.168.1.70, and the routing table has:

• 192.168.1.0/24

• 192.168.1.64/26

The router chooses /26 because it is more specific.

Step 2: Lowest Administrative Distance

If multiple routes have the same prefix length, the router chooses the one with the lowest AD.

Example: If the router has:

• OSPF route: AD = 110

• Static route: AD = 1

The static route is chosen because AD 1 is lower than AD 110.

Step 3: Lowest Metric

If multiple routes have the same AD, the router chooses the one with the lowest metric.

Example: If the router has:

• OSPF route 1: Metric = 2

• OSPF route 2: Metric = 5

The route with metric 2 is chosen.

Longest Prefix Match (The Rule That Fails Most Students)

Longest Prefix Match is the most important rule in routing. It is also the one that confuses most students.

When a router receives a packet for 192.168.1.57, its routing table might contain several entries that all technically match:

• 0.0.0.0/0 → default gateway

• 192.168.0.0/16 → office network

• 192.168.1.0/24 → third-floor subnet

All three cover 192.168.1.57. The rule is: the most specific prefix wins — the one with the longest prefix length. That is 192.168.1.0/24 (length 24 beats length 16 beats length 0).

Example in Binary:

Destination IP: 192.168.2.82 = 11000000.10101000.00000010.01010010

Matching prefixes:

• 192.168.2.80/29 = 11000000.10101000.00000010.01010000 (matches 29 bits)

• 192.168.2.64/27 = 11000000.10101000.00000010.01000000 (matches 27 bits)

• 192.168.2.0/24 = 11000000.10101000.00000010.00000000 (matches 24 bits)

The router chooses /29 because it has the most matching bits.

Administrative Distance Explained Without Memorization

Administrative Distance (AD) is the measure of trustworthiness a router assigns to the source of a routing update. When a router knows a route to the same destination prefix from two different sources (e.g., one from OSPF and one from a static route), it installs only the route with the lower AD into the routing table. The higher-AD route is held as a backup but does not appear in show ip route unless the lower-AD route disappears .

Cisco's Learning Network explains that administrative distance is the measure of trustworthiness a router assigns to a routing information source. Cisco IOS uses administrative distance to determine which route to install into the IP routing table. The lower the administrative distance, the more trustworthy the route source. Cisco assigns default administrative distances to each routing protocol: EIGRP has an AD of 90, OSPF has 110, RIP has 120, and static routes have 1. Connected routes have the highest trustworthiness with an AD of 0.

Route Source	AD	Why?
Connected	0	Most trusted — the router IS on this network
Static	1	Very trusted — manually configured by admin
EIGRP	90	Cisco's proprietary protocol — highly reliable
OSPF	110	Industry-standard protocol — reliable
RIP	120	Older protocol — less reliable

AD Decision Example :

Router knows 10.1.1.0/24 from two sources:

• OSPF says: via 192.168.1.2 [110/20] ← AD = 110

• Static: via 10.0.0.2 [1/0] ← AD = 1

Router installs: S 10.1.1.0/24 [1/0] via 10.0.0.2 (lower AD wins)

The OSPF route is NOT in the routing table until the static route is removed .

This is why a misconfigured static route can silently override a dynamic routing protocol — always check show ip route when debugging .

---

Metric: The Tie-Breaker Most Beginners Misunderstand

Metric is a number that represents the cost of a route. Different routing protocols use different metrics .

Protocol	Metric
OSPF	Cost based on bandwidth
EIGRP	Composite metric based on bandwidth, delay, reliability, load, MTU
RIP	Hop count (max 15, 16 = unreachable)

When multiple routes have the same AD, the router chooses the one with the lowest metric .

Example :

• OSPF route 1: [110/20] → Metric = 20

• OSPF route 2: [110/30] → Metric = 30

The router chooses route 1 because metric 20 is lower than 30.

---

Gateway of Last Resort and Default Routes

The gateway of last resort is the default route. When a router receives a packet destined for a network not in its routing table, it sends it to the gateway of last resort.

Cisco support documentation explains default routes and the gateway of last resort. According to Cisco, default routes direct packets addressed to networks not explicitly listed in the routing table. Default routes are invaluable in topologies where learning all specific networks is not desirable or practical. A default route is configured as 0.0.0.0/0 and serves as a catch-all for traffic that does not match any other entry in the routing table. When a gateway of last resort is not set, packets with no matching route are dropped.

Cisco Support: Configure a Gateway of Last Resort

Gateway of last resort is 10.0.0.2 to network 0.0.0.0

This line appears at the top of the show ip route output if a default route is configured. If you see "Gateway of last resort is not set", no default route exists, and packets with no matching prefix will be DROPPED .

The default route is represented as 0.0.0.0/0 and has the lowest possible prefix length (0 bits) . It matches any destination, but only if no more specific route exists .

Example:

..

S*      0.0.0.0/0 [1/0] via 10.0.0.2

• S* = Static default route

• * = candidate default (this IS the default route)

• [1/0] = AD 1, Metric 0

• via 10.0.0.2 = next-hop 

---

A Real Packet Tracer Example

Let us look at a real routing table from a router with OSPF, static, and connected routes .

..

Router# show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile,
       B - BGP, D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

Gateway of last resort is 10.0.0.2 to network 0.0.0.0

C       10.0.0.0/30 is directly connected, Serial0/0/0
L       10.0.0.1/32 is directly connected, Serial0/0/0
S*      0.0.0.0/0 [1/0] via 10.0.0.2
O       10.1.1.0/24 [110/20] via 192.168.1.2, 00:05:43, GigabitEthernet0/1
C       192.168.1.0/30 is directly connected, GigabitEthernet0/1
L       192.168.1.1/32 is directly connected, GigabitEthernet0/1

What this tells you :

1. There is a default route via 10.0.0.2 (gateway of last resort is set)

2. 10.0.0.0/30 is directly connected on Serial0/0/0 (C route)

3. The router's own IP on that interface is 10.0.0.1 (L route — /32 host route)

4. 10.1.1.0/24 is learned via OSPF (AD 110, metric 20) through next-hop 192.168.1.2

5. 192.168.1.0/30 is directly connected on GigabitEthernet0/1 (C route)

6. The router's own IP on that interface is 192.168.1.1 (L route — /32 host route)

Note: In Cisco IOS 15, active interfaces appear in the routing table with two entries — C (connected) and L (local). In previous IOS versions, only a single entry with C would appear .

---

Five Routing Table Mistakes That Cost Marks in the CCNA Exam

Mistake	Why It Costs Marks	Fix
Ignoring Longest Prefix Match	Exam questions love testing this. Students choose a broader route when a more specific route exists .	Always check prefix length. The most specific route wins .
Mixing Up AD and Metric	AD compares different protocols. Metric compares same protocols .	Remember: AD first, then metric. Lower is better for both.
Not Checking the Next-Hop	A route with an unreachable next-hop is useless .	Always verify that the next-hop is reachable in the routing table.
Forgetting the Gateway of Last Resort	If no default route exists, packets without a matching route are dropped .	Always configure a default route for internet access .
Misunderstanding Route Codes	Confusing OSPF (O) with EIGRP (D) or RIP (R) leads to wrong troubleshooting .	Memorize the common codes: C, L, S, O, D, R, B .

---

How Network Engineers Troubleshoot Using show ip route

Network engineers use show ip route to verify that routes are being installed correctly and to troubleshoot connectivity issues .

The first command used to check for convergence after configuring routing is always show ip route .

Troubleshooting Example :

Devices cannot connect to server 172.16.1.100. Using show ip route, the administrator checks if a routing entry exists to network 172.16.1.0/24. If the routing table does not have a specific route to SRV1's network, the administrator must then check for the existence of a default or summary route entry in the direction of the 172.16.1.0/24 network. If none exists, the problem may be with routing, and the administrator must verify that the network is included within the dynamic routing protocol configuration or add a static route .

Cisco networking documentation explains that the show ip route command verifies whether routes received by routing neighbors are installed in the IPv4 routing table. Network professionals use it as the first command to check for convergence after configuring routing protocols. This command confirms whether routing updates are being received and processed correctly. Network engineers also use show ip route to verify that static routes are properly entered and to ensure floating static routes are present in the routing table.

Cisco Live: Local Host Routes in Cisco IOS and IOS-XR

Verification Commands :

Command	Use
show ip interface brief	Displays a summary for all interfaces including IPv4 address and operational status
show ip route	Displays the contents of the IPv4 routing table stored in RAM
show ip route [destination-ip]	Verifies which route the router will use for a specific destination

---

Summary: What You Learned Today

Concept	What You Now Know
Routing Table	A database of known networks and paths
Route Codes	C (connected), L (local), S (static), O (OSPF), D (EIGRP), R (RIP), B (BGP)
Administrative Distance	Trustworthiness of a route. Lower = more trusted
Metric	Cost of a route. Lower = better
Longest Prefix Match	The most specific route wins
Next-Hop	Where to send packets for a destination
Gateway of Last Resort	Default route for unknown destinations
C and L Routes	C = directly connected network; L = router's own IP (/32)

---

📌 Related: Read TCP vs UDP Explained and IPv6 Addressing for Beginners for more networking basics.

---

Your Action Step for Today

1. Open a router (real or Packet Tracer).

2. Type show ip route and examine the output.

3. Identify each route: What protocol? What AD? What metric?

4. Find the gateway of last resort.

5. Use show ip route [destination-ip] to verify which route the router will use for a specific destination .

6. Comment below with any route you do not understand.

Final Thoughts

A routing table is a map of your network. Once you understand how to read it, you can troubleshoot almost any routing issue.

Remember: C, L, S, O, D, R, B — these letters tell you where the route came from. AD and metric tell you which route is best. And the next hop tells you where to send traffic.

Do not ignore the routing table. It is your best troubleshooting tool. When you understand what the router is telling you, you can fix problems faster and build more reliable networks.

➡️ Next: Static Routing vs Default Routing: When Should You Use Each?

If this guide helped you, share it with someone who is struggling with routing tables.