The routing table is the single most important piece of state on a Cisco router, and show ip route is the command you will type more than any other. Yet most people skim it: they look for the destination, glance at the next hop, and move on. Read it properly and every line tells you which protocol installed the route, how much the router trusts that source, what the path cost is, how long it has been stable, and which interface the packet leaves through. This guide walks the output line by line, using real captures from a live Cisco IOS XE lab. It is part of the IP Routing complete guide, and once you can read the table fluently the rest of routing gets a lot less mysterious.
The command and what it produces
On a router named R1 running OSPF, EIGRP, a static route, and its own connected interfaces, here is the full table:
R1#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, m - OMP
n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
H - NHRP, G - NHRP registered, g - NHRP registration summary
o - ODR, P - periodic downloaded static route, l - LISP
a - application route
+ - replicated route, % - next hop override, p - overrides from PfR
& - replicated local route overrides by connected
Gateway of last resort is not set
1.0.0.0/32 is subnetted, 1 subnets
C 1.1.1.1 is directly connected, Loopback0
2.0.0.0/32 is subnetted, 1 subnets
D 2.2.2.2 [90/409600] via 10.0.12.2, 00:07:28, Ethernet0/1
3.0.0.0/32 is subnetted, 1 subnets
O 3.3.3.3 [110/11] via 10.0.13.2, 00:06:41, Ethernet0/2
10.0.0.0/8 is variably subnetted, 9 subnets, 4 masks
C 10.0.12.0/30 is directly connected, Ethernet0/1
L 10.0.12.1/32 is directly connected, Ethernet0/1
C 10.0.13.0/30 is directly connected, Ethernet0/2
L 10.0.13.1/32 is directly connected, Ethernet0/2
D 10.0.20.0/24 [90/307200] via 10.0.12.2, 00:07:28, Ethernet0/1
O 10.0.23.0/30 [110/20] via 10.0.13.2, 00:06:41, Ethernet0/2
[110/20] via 10.0.12.2, 00:06:41, Ethernet0/1
O 10.0.30.0/24 [110/11] via 10.0.13.2, 00:06:41, Ethernet0/2
S 10.0.30.0/25 [1/0] via 10.0.12.2
O 10.0.40.0/24 [110/20] via 10.0.12.2, 00:06:44, Ethernet0/1
192.168.99.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.99.0/24 is directly connected, Ethernet0/0
L 192.168.99.1/32 is directly connected, Ethernet0/0That is a lot of screen, but it decomposes into four parts: the codes legend, the gateway of last resort line, the parent (classful) headers, and the child route entries. Take them in order.
The codes legend
The block at the top is a static legend. It never changes with your topology, so experienced engineers stop reading it. The letters that matter are the ones that actually appear in the left margin below. In this table you can see L, C, S, D, and O. Learn these five and you can read most enterprise tables:
Connected. A subnet on an up/up interface. The router owns the wire.
Local. The router's own /32 host address on that interface. Always paired with a C entry.
Static. You typed ip route. An S* marks a static default route.
EIGRP. The D is for DUAL, EIGRP's algorithm. D EX means an external (redistributed) route.
OSPF. O IA is inter-area; O E1/E2 are external. Plain O is intra-area.
BGP. Not in this table, but you will see it the moment the router speaks to another autonomous system.
Gateway of last resort
The line Gateway of last resort is not set tells you the router has no default route. If a packet arrives for a destination that matches nothing in the table, it gets dropped and the sender receives an ICMP destination-unreachable. Add a default route (or receive one from a neighbor) and this line changes to name the next hop, and a route flagged with * appears. On an edge router this line should almost always point somewhere; on a core router with full routing it is often intentionally absent.
Parent and child routes: the subnetting headers
Cisco groups routes under classful parent lines. Look at this pair:
10.0.0.0/8 is variably subnetted, 9 subnets, 4 masks
C 10.0.12.0/30 is directly connected, Ethernet0/1The indented, code-less line (10.0.0.0/8 is variably subnetted, 9 subnets, 4 masks) is a parent route, also called a classful header. It is not a forwarding entry; it is a summary telling you that within the classful 10.0.0.0/8 space, the router holds 9 child subnets carved with 4 different mask lengths (/30, /32, /24, /25 here). The lines below it with an actual code letter are the child routes, and those are what the router forwards on. "Variably subnetted" simply means VLSM is in use, which it almost always is. When you are counting how many real routes exist, count the coded lines, not the headers.
Anatomy of a single route entry
Take one line and name every field:
O 10.0.23.0/30 [110/20] via 10.0.13.2, 00:06:41, Ethernet0/2The two-number bracket trips people up constantly, so commit it to memory: the first number is administrative distance (how much the router trusts the source), the second is metric (how good the path is according to that source). AD is compared across protocols; metric is only ever compared within one protocol. There is a whole article on this in administrative distance, the complete table, because getting it wrong is how people accidentally black-hole traffic.
Connected and local: the C/L pair
Notice that every connected interface produces two entries:
C 10.0.12.0/30 is directly connected, Ethernet0/1
L 10.0.12.1/32 is directly connected, Ethernet0/1The C route is the whole subnet (10.0.12.0/30) reachable out that interface. The L route is the router's own IP on that subnet as a /32 host route (10.0.12.1/32). The local route exists so the router can recognize traffic addressed to itself and punt it to the control plane instead of forwarding it. You cannot delete an L route directly; it lives and dies with the interface address. Connected and local both have an implicit administrative distance of 0 and 0 respectively, which is why nothing ever beats a directly connected subnet.
Equal-cost paths: two next hops, one destination
This entry has two lines under it:
O 10.0.23.0/30 [110/20] via 10.0.13.2, 00:06:41, Ethernet0/2
[110/20] via 10.0.12.2, 00:06:41, Ethernet0/1OSPF found two paths to 10.0.23.0/30 with the identical cost of 20, so the router installed both and load-balances across them. This is equal-cost multipath (ECMP). To see how the router actually splits traffic, ask for the route detail:
R1#show ip route 10.0.23.0
Routing entry for 10.0.23.0/30
Known via "ospf 1", distance 110, metric 20, type intra area
Last update from 10.0.12.2 on Ethernet0/1, 00:06:41 ago
Routing Descriptor Blocks:
10.0.13.2, from 3.3.3.3, 00:06:41 ago, via Ethernet0/2
Route metric is 20, traffic share count is 1
* 10.0.12.2, from 3.3.3.3, 00:06:41 ago, via Ethernet0/1
Route metric is 20, traffic share count is 1The detail view is where the real diagnostic information lives. Known via "ospf 1" names the exact process. type intra area tells you the route is internal to the OSPF area. Each Routing Descriptor Block is one usable next hop; the asterisk marks the path CEF will use for the next flow (it rotates on a per-flow basis). traffic share count is 1 on both means a 50/50 split. When you are troubleshooting "why is traffic taking that path," show ip route <destination> answers it faster than staring at the full table.
Filtering the table so it fits your brain
On a real router the full table can be thousands of lines. Filter it. To see only OSPF-learned routes:
R1#show ip route ospf
3.0.0.0/32 is subnetted, 1 subnets
O 3.3.3.3 [110/11] via 10.0.13.2, 00:06:42, Ethernet0/2
10.0.0.0/8 is variably subnetted, 9 subnets, 4 masks
O 10.0.23.0/30 [110/20] via 10.0.13.2, 00:06:42, Ethernet0/2
[110/20] via 10.0.12.2, 00:06:42, Ethernet0/1
O 10.0.30.0/24 [110/11] via 10.0.13.2, 00:06:42, Ethernet0/2
O 10.0.40.0/24 [110/20] via 10.0.12.2, 00:06:45, Ethernet0/1Swap in connected, static, eigrp, or bgp to isolate any source. When you need the shape of the table rather than the routes themselves, ask for the summary:
R1#show ip route summary
IP routing table name is default (0x0)
IP routing table maximum-paths is 32
Route Source Networks Subnets Replicates Overhead Memory (bytes)
connected 0 7 0 784 2184
static 0 1 0 112 312
ospf 1 0 4 0 560 1264
Intra-area: 4 Inter-area: 0 External-1: 0 External-2: 0
eigrp 100 0 2 0 448 624
internal 5 2880
Total 5 14 0 1904 7264This tells you at a glance that OSPF contributed 4 subnets, EIGRP 2, static 1, and connected 7, and roughly how much memory the table consumes. On a router that is running out of memory or hitting a route-scale limit, this is the first place to look.
What the table does not tell you
The routing table (the RIB, or Routing Information Base) is the control-plane picture: the best routes each protocol offered, after AD and metric were applied. It is not what actually forwards packets in hardware. That job belongs to CEF (the Forwarding Information Base). Usually they agree, but when you are chasing a forwarding bug, compare them with show ip cef <destination>. If a route is in the RIB but CEF points somewhere else, you have found something worth investigating. This distinction matters most when longest prefix match picks a more specific route than you expected.
Key takeaways
Read the routing table as four layers: the codes legend (memorize C, L, S, D, O, B), the gateway-of-last-resort line, the classful parent headers (summaries, not forwarding entries), and the coded child routes that actually forward. In each route entry the bracket is [administrative distance / metric], the via is the next hop, and the trailing interface is where the packet leaves. Use show ip route <destination> for the detail block whenever you need to know exactly why a path was chosen, and show ip route <protocol> to cut a huge table down to what you care about. Everything else in routing (choosing between sources, picking the most specific prefix, building failover) reads off these same fields, and the IP Routing complete guide ties them together.
