Routing Decision Process

Mental model

When a packet arrives at a router, the router asks a series of questions to decide where to send it. The order matters more than people realize:

1. Longest prefix match — among all routes that could reach the destination, pick the most specific (highest CIDR number).
2. Administrative distance — among routes with the same prefix length, pick the one from the most trusted source (lowest AD).
3. Metric — among routes with the same prefix length AND same source, pick the cheapest one.

This is the entire decision-making process. Memorize the order — it explains every “why is my router doing X” mystery you’ll meet.

Why longest match comes first

Destination: 10.1.1.5

Routes in the table:
  10.0.0.0/8     via R2   [OSPF — AD 110]
  10.1.0.0/16    via R3   [OSPF — AD 110]
  10.1.1.0/24    via R4   [Static — AD 1]

All three routes could deliver to 10.1.1.5. But the /24 is more specific than /16 or /8. The /24 wins, regardless of AD.

If you had:

  10.1.1.0/24    via R4   [Static — AD 1]
  10.1.1.4/30    via R5   [OSPF — AD 110]

The /30 (4 IPs) beats the /24 (256 IPs) for 10.1.1.5, even though OSPF’s AD is way higher than static’s. More specific always wins.

Administrative distance (AD) — the “trust score”

When two protocols both have the same prefix, AD decides which to install in the routing table. Lower = more trusted.

Source	AD
Connected interface	0
Static route	1
EBGP	20
EIGRP (internal)	90
OSPF	110
RIP	120
EIGRP (external)	170
IBGP	200
Unreachable	255

Memorize the common ones: Connected=0, Static=1, OSPF=110, RIP=120.

If R1 learns 10.0.0.0/24 from OSPF (AD 110) and also from RIP (AD 120), only the OSPF route is installed. RIP’s version stays in its protocol database but never enters show ip route.

Metric — when AD ties

If two routes have the same prefix AND the same protocol (so same AD), the protocol’s own metric breaks the tie:

Protocol	Metric
OSPF	Cost (10⁷ / bandwidth in bps, summed across path)
EIGRP	Composite of bandwidth + delay
RIP	Hop count
Static	None — first-configured wins

Two OSPF paths to the same destination with costs 4 and 10? The cost-4 path is installed; the cost-10 sits in the LSDB but isn’t used unless the cost-4 fails. Equal-cost paths can both install (ECMP — equal-cost multi-path), giving you free load balancing.

What “installed in the routing table” means

R1# show ip route
   10.1.1.0/24 [110/20] via R3
   10.1.0.0/16 [110/15] via R2

The [110/20] is [AD/metric] — the candidates that won. Other learned routes don’t appear here at all. To see them in the protocol’s internal database:

R1# show ip ospf database
R1# show ip eigrp topology

Floating static — using AD as a knob

Static’s default AD is 1, beating everything. But you can artificially raise it:

R1(config)# ip route 10.0.0.0 255.255.255.0 10.99.99.2 200

That AD of 200 means: this static loses to OSPF (AD 110). It’s a floating static — only used if OSPF disappears. Common backup pattern. See Static Routing for the deep dive.

Commands

Trace exactly which route a router would use

R1# show ip route 10.1.1.5
Routing entry for 10.1.1.0/24
  Known via "static", distance 1, metric 0
  Routing Descriptor Blocks:
  * 192.168.1.2
      Route metric is 0, traffic share count is 1

The most useful single command for routing troubleshooting. Tells you the route, AD, metric, and next-hop the router actually picked.

Compare protocol databases

R1# show ip route                       ! installed routes
R1# show ip ospf database               ! everything OSPF knows
R1# show ip eigrp topology              ! everything EIGRP knows
R1# show ip protocols                   ! routing-protocol summary

Common mistakes

1. Assuming AD beats prefix length. It doesn’t. Longest match is always checked first. A /30 static beats a /16 OSPF.

2. Confusing metric across protocols. OSPF cost 10 and EIGRP metric 30,000 aren’t comparable — they’re different units. AD decides which protocol wins; metric only matters within the same protocol.

3. Expecting show ip route to show everything. Only installed routes appear there. To see candidates that lost, check the protocol-specific database.

4. Forgetting floating static’s AD. A backup static with no AD specified defaults to AD 1 and becomes the primary path. Always specify AD on backup statics.

5. Misreading [AD/metric]. People sometimes think both numbers are arbitrary identifiers. Left = administrative distance, right = metric. Both lower-is-better.

6. Not understanding ECMP. When two routes tie on all three criteria, both install. Traffic load-balances. If you expected only one path, check show ip route for multiple via X lines.

Lab to try tonight

1. Three routers. R1 connected to R2 and R3. R2 and R3 both reach 10.2.2.0/24 directly.
2. Configure OSPF between R1, R2, R3. Verify R1 sees two OSPF routes to 10.2.2.0/24 (one via R2, one via R3).
3. Run show ip route 10.2.2.0 — observe ECMP (equal-cost multi-path).
4. Configure a static route on R1: ip route 10.2.2.0 255.255.255.0 <R2-IP> (no AD specified).
5. Re-check show ip route 10.2.2.0. The static beats both OSPF routes (AD 1 vs 110). Both OSPF paths disappear.
6. Remove the static. Re-add with AD 200. Now OSPF wins, static stays dormant.
7. Bonus: add a more specific static for 10.2.2.0/28. Now both routes coexist — /28 for traffic to .0-.15, /24 for the rest.

Cheat strip

Step	Question	What wins
1	Which route is most specific?	Highest prefix length (/30 > /24 > /16 > /8 > /0)
2	Same prefix — which protocol?	Lowest AD
3	Same AD — which path?	Lowest metric
Default ADs	Static=1, OSPF=110, RIP=120, EIGRP=90, Connected=0
ECMP	Same AD + same metric = both install, load-balance
show ip route X	The fastest way to ask “what would the router do for X?”