IP Routing: The Complete Guide

IP routing is the process a router uses to decide where a packet goes next. It sounds simple, and the core loop is: look at the destination address, find the best matching route, forward out the interface that route names. But "best matching route" hides three separate decisions stacked on top of each other, and misunderstanding their order is behind a large share of real-world outages. This guide is the hub for everything routing on PingLabz. It explains how a router actually chooses a path, walks the routing table field by field, and links out to focused deep-dives, all grounded in real Cisco IOS XE output captured from a live lab. Whether you are studying for the CCNA (IP connectivity is the single heaviest-weighted exam domain) or you troubleshoot routers for a living, this is the reference to bookmark.

This guide covers how a router forwards a packet, the administrative distance ranking that decides between protocols, the anatomy of show ip route, minimum viable static and dynamic routing on IOS XE, and the operational traps (recursion, floating statics, equal-cost paths) that bite in production.

What routing solves

A switch moves frames within one broadcast domain using MAC addresses. The moment a packet needs to cross from one IP subnet to another, you need a router, and the router needs to know a path to the destination network. Routing is how that knowledge gets into the router (statically by hand, or dynamically from a protocol) and how the router chooses among competing paths once it has them. Every ping that crosses a subnet boundary, every internet request, every branch-to-datacenter flow rides on a routing decision made in microseconds by comparing the destination against a table.

How a router forwards a packet: the three-stage pipeline

When a packet arrives, the router runs three checks in a fixed order. This ordering is the most important concept in routing, because each stage can override your intuition about the next:

Say that order out loud until it sticks: prefix length, then distance, then metric. The classic mistake is assuming a static route (AD 1) always beats OSPF (AD 110). It does not if the OSPF route is more specific, because prefix length is checked first.

The administrative distance reference

Administrative distance ranks how much a router trusts each source of routing information. Lower is more trusted. These are the IOS XE defaults:

Routing table anatomy

The routing table is the router's decision record. Here is a real one from a router running OSPF, EIGRP, a static route, and connected interfaces:

R1#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       ...
Gateway of last resort is not set

      2.0.0.0/32 is subnetted, 1 subnets
D        2.2.2.2 [90/409600] via 10.0.12.2, 00:07:28, Ethernet0/1
      3.0.0.0/32 is subnetted, 1 subnets
O        3.3.3.3 [110/11] via 10.0.13.2, 00:06:41, Ethernet0/2
      10.0.0.0/8 is variably subnetted, 9 subnets, 4 masks
C        10.0.12.0/30 is directly connected, Ethernet0/1
L        10.0.12.1/32 is directly connected, Ethernet0/1
D        10.0.20.0/24 [90/307200] via 10.0.12.2, 00:07:28, Ethernet0/1
O        10.0.23.0/30 [110/20] via 10.0.13.2, 00:06:41, Ethernet0/2
                      [110/20] via 10.0.12.2, 00:06:41, Ethernet0/1
S        10.0.30.0/25 [1/0] via 10.0.12.2

Each entry reads: source code, destination/prefix, [administrative distance/metric], via next-hop, age, and outgoing interface. The C/L pair is the connected subnet plus the router's own /32 on it. The indented, code-less lines (10.0.0.0/8 is variably subnetted...) are classful parent summaries, not forwarding entries. When a route lists two next hops (the 10.0.23.0/30 above), it is equal-cost multipath. The full field-by-field walkthrough is in how to read the Cisco routing table.

Where routes come from: the source codes

Every route in the table carries a one or two letter code in the left margin naming the source that installed it. You will read these thousands of times, so learn the common ones cold:

To see how many routes each source contributed without scrolling the whole table, ask for the summary:

R1#show ip route summary
Route Source    Networks    Subnets     Replicates  Overhead    Memory (bytes)
connected       0           7           0           784         2184
static          0           1           0           112         312
ospf 1          0           4           0           560         1264
eigrp 100       0           2           0           448         624
Total           5           14          0           1904        7264

This one command tells you the table's shape: 7 connected, 4 from OSPF, 2 from EIGRP, 1 static, and how much memory the table uses. On a router hitting a scale limit, this is the first place to look.

Minimum viable static routing on IOS XE

Static routing is the simplest way to get packets moving, and it never fully goes away. The three forms and the default route:

! Next-hop static to a specific subnet
R1(config)# ip route 10.0.30.0 255.255.255.128 10.0.12.2

! Host route (a /32) to one device
R1(config)# ip route 3.3.3.3 255.255.255.255 10.0.13.2

! Fully specified (interface + next hop) - fails over cleanly
R1(config)# ip route 3.3.3.3 255.255.255.255 Ethernet0/2 10.0.13.2

! Default route (route of last resort)
SW1(config)# ip route 0.0.0.0 0.0.0.0 10.0.20.1

A default route shows as S* and the router reports its Gateway of last resort:

SW1#show ip route | begin Gateway
Gateway of last resort is 10.0.20.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 10.0.20.1

Full detail, including the floating-static backup pattern and its administrative-distance trap, is in static routing on Cisco IOS XE.

Minimum viable dynamic routing on IOS XE

Static routing does not scale past a handful of networks; dynamic protocols learn and adapt automatically. A minimal OSPF and EIGRP config:

! OSPF: advertise networks into area 0
R1(config)# router ospf 1
R1(config-router)# router-id 1.1.1.1
R1(config-router)# network 10.0.12.0 0.0.0.3 area 0
R1(config-router)# network 10.0.13.0 0.0.0.3 area 0

! EIGRP: named mode, autonomous system 100
R1(config)# router eigrp 100
R1(config-router)# network 10.0.12.0 0.0.0.3

Once they are up, the protocols populate the table and the three-stage pipeline decides which routes win. Each protocol has its own complete guide: OSPF (link-state, the enterprise standard), EIGRP (Cisco's advanced distance-vector protocol), and BGP (the routing protocol of the internet). For a redundant default gateway on a LAN, the routing protocols hand off to FHRP.

Operational concerns

• Recursive routes. A next-hop-only static must resolve its next hop through another route. If the direct link dies but the next hop is still reachable the long way, the static lingers and can loop. Fully specify the interface for anything that must fail over.
• Floating statics. A backup static's administrative distance must beat every source that can offer the same prefix, not just the primary static. Set it to 250 to back up a static, but 105 (below OSPF's 110) to back up OSPF.
• Equal-cost multipath. When a protocol finds two paths of equal metric, the router installs both and load-balances per flow. Use show ip route <destination> to see the descriptor blocks and which path is active.
• RIB versus FIB. The routing table (RIB) is the control-plane decision; CEF (the FIB) is what forwards in hardware. When they disagree, you have found a bug. Compare with show ip cef <destination>.

Equal-cost multipath in practice

When a routing protocol finds two paths to the same destination with an identical metric, IOS XE installs both and load-balances across them. You can see it directly in the table, where one destination lists two next hops:

O        10.0.23.0/30 [110/20] via 10.0.13.2, 00:06:41, Ethernet0/2
                      [110/20] via 10.0.12.2, 00:06:41, Ethernet0/1

Both paths have the OSPF cost of 20, so both are usable. The route detail shows each as a separate descriptor block with a traffic share count, and CEF hashes each flow to one path so a given conversation stays on a single link (avoiding out-of-order delivery). Equal-cost multipath is free bandwidth and resilience when your topology is symmetric, and it is why engineers deliberately build parallel links of equal cost. When the costs are not equal, only the best path installs, unless you are running EIGRP with variance configured for unequal-cost load-balancing, which is a feature unique to EIGRP.

Troubleshooting routing

A short, high-yield command set:

show ip route <destination>      ! the winning route, its AD, and why
show ip route <protocol>         ! isolate one source (ospf, eigrp, static, connected)
show ip cef <destination>        ! what actually forwards in hardware
show ip protocols                ! which protocols run and their distances
traceroute <destination>         ! the path a packet really takes

When traffic takes a path you did not expect, work the pipeline in order: is a more specific prefix winning (longest prefix match)? If not, is a lower-AD source winning (administrative distance)? If not, is the metric steering it? Nine times out of ten the answer is in the first two.

A worked example: tracing one decision end to end

Tie it all together with a single destination. Router R1 needs to forward a packet to 10.0.30.1. Its table holds two overlapping routes: an OSPF /24 and a static /25. Watch the pipeline run:

R1#show ip route | include 10.0.30
O        10.0.30.0/24 [110/11] via 10.0.13.2, Ethernet0/2
S        10.0.30.0/25 [1/0] via 10.0.12.2

R1#show ip route 10.0.30.1
Routing entry for 10.0.30.0/25
  Known via "static", distance 1, metric 0
  * 10.0.12.2

Stage 1 (longest prefix match) eliminated the /24 immediately, because 10.0.30.1 falls inside the more specific /25. The /24 never even reached the AD comparison. Had the destination been 10.0.30.200 (outside the /25), stage 1 would have left only the /24 and the router would have used OSPF. A single lookup, decided almost entirely by prefix length. This is why "which route wins?" is always answered prefix-length-first, and why a low-AD static does not automatically beat a dynamic route.

Route control: beyond a single protocol

Once a network runs more than one routing protocol, or needs traffic to disobey the routing table on purpose, you are in route control territory. Route redistribution on Cisco IOS XE moves routes between protocol domains with seed metrics and external route types, and the moment you add a second redistribution point you need the route-tag loop prevention design (we captured a live routing loop forming, then fixed it). When redistribution misbehaves, the redistribution troubleshooting runbook walks the failure signatures with real output. Policy-based routing (PBR) overrides the table per source or application, VRF-Lite splits one router into isolated routing tables, and BFD gives every protocol sub-second failure detection (34 seconds down to 0.58 in our timed lab captures).

Routing and IPv6

Everything above describes IPv4, but the machinery is identical for IPv6: the same three-stage pipeline, the same administrative distances, the same longest-prefix-match logic against 128-bit addresses instead of 32-bit ones. The commands change prefix (show ipv6 route, ipv6 route, router ospfv3), and the address format is longer, but the decision process you learned here transfers directly. The IPv6 complete guide covers the addressing and the protocol differences; the routing logic is the same one you have been reading. For dynamic IPv6 routing, OSPFv3 explained covers what changed from OSPFv2 (and how address families carry IPv4 too), with the step-by-step build in the OSPFv3 configuration guide.

The full IP Routing cluster, in reading order

Work through these in sequence for a complete picture, or jump to the one you need:

Routing does not live in isolation. It sits on top of the addressing and switching in the Network Fundamentals guide, and it feeds the services (NAT, DHCP, NTP) covered in the IP Services guide.

Frequently asked questions

What is administrative distance in simple terms?

It is a number from 0 to 255 that ranks how much a router trusts each source of a route. When two routing protocols offer the same destination, the router installs the one with the lower administrative distance and ignores the other. Connected is 0, static is 1, EIGRP is 90, and OSPF is 110, so EIGRP beats OSPF by default.

Which route wins if two sources have the same administrative distance?

That normally cannot happen between two different protocols because each has a distinct default AD. Within one protocol, AD is identical for every route, so the metric breaks the tie, and if the metrics are also equal the router installs both as equal-cost multipath and load-balances.

What does the S* in the routing table mean?

The S means static and the asterisk marks it as a candidate default route. You see S* 0.0.0.0/0 when you have configured a static default route, and the router reports it as the "gateway of last resort."

How do I see exactly why a router chose a particular route?

Run show ip route <destination>. It shows the winning source (Known via "ospf 1"), the administrative distance and metric, every usable next hop as a routing descriptor block, and which one is currently active. To confirm what forwards in hardware, add show ip cef <destination>.

Do I need dynamic routing, or are static routes enough?

For a handful of networks with stable paths, static routing is simpler and perfectly fine. Past that, static routes do not scale or adapt to failures on their own, so you run a dynamic protocol (OSPF or EIGRP internally, BGP at the edge) and use static routes for defaults and backups.

Key takeaways

A router forwards by running three checks in order: longest prefix match first (most specific route wins, always), then administrative distance (lowest-AD source wins between protocols), then metric (best path within one protocol). Read any route straight off show ip route, where the bracket is [AD/metric], the via is the next hop, and code-less indented lines are just classful summaries. Static routing covers defaults, host routes, and backups, but its floating-static AD must be positioned against every competing source. When routing behaves unexpectedly, walk the pipeline in order and confirm with show ip route <destination> and show ip cef. From here, dive into the individual protocols (OSPF, EIGRP, BGP) and the deep-dives listed above.