A router’s table lists destination prefixes, each with a next hop or interface and a metric, and the router forwards every packet by the longest prefix that matches its destination address. An address matches a route when the address ANDed with the route’s mask equals the route’s network address. With routes for 10.0.0.0/8, 10.2.0.0/24 and 10.2.0.128/25, destination 10.2.0.200 follows the /25, 10.2.0.77 follows the /24 and 10.7.3.4 falls back to the /8, and a packet that matches nothing is dropped unless a default route exists.
Part of Networking
How a router stores routes and looks up a destination: the matching test, the longest-prefix rule, ties, defaults and the faults that follow from them.
The Most Specific Route Wins, Whatever Order They Are Listed In
Routing Basics states the rule and gives one example: with entries for 192.168.0.0/16 and 192.168.1.0/24, the destination 192.168.1.50 uses the /24 because it is the more specific. It also names the three fields of an entry: a destination prefix, a next-hop address or outgoing interface, and a metric, and it describes the default route 0.0.0.0/0. This article works the lookup through with several overlapping routes, because the rule is what makes aggregation and exceptions possible (CIDR Notation) and it is the place where mistakes hide.
A route matches a destination when (destination AND mask) = network. Several routes can match at once. The router picks the match with the greatest prefix length. Among equal prefixes the lower metric wins (Routing Basics gives the metric as the cost used when several routes to the same destination exist). Order in the list does not matter.
What You Need
- The table of the router — on Linux
ip route showlists it (Routing Basics) - The mask arithmetic from Subnet Masks
- A pencil
Method: Look A Destination Up By Hand
Step 1: Test every route For each route compute destination AND mask and compare it with the route’s network address. Only the differing octet needs thought.
Step 2: Keep the matches and take the longest prefix If two matches have the same prefix length, take the lower metric.
Step 3: Forward Send to that route’s next hop, or deliver directly if the route is a connected network. If nothing matches and there is no default route, the packet is dropped, and an error goes back to the sender.
On a live Linux router the command ip route get 10.2.0.200 reports the route the kernel would use; it is general knowledge, not from the other articles, so confirm it on your own system.
Worked Example: Six Routes, Five Destinations
Router R has interface eth0 on 10.1.0.1/24, and eth1 10.255.0.1/30, eth2 10.255.0.5/30 and eth3 10.255.0.10/30 on three links. Its table:
| Destination | Next hop |
|---|---|
| 10.1.0.0/24 | connected, eth0 |
| 10.2.0.0/24 | via 10.255.0.2 |
| 10.2.0.128/25 | via 10.255.0.6 |
| 10.0.0.0/8 | via 10.255.0.9 |
| 192.168.0.0/16 | via 10.255.0.2 |
| 0.0.0.0/0 | via 10.255.0.9 |
Each next hop lies on a connected link: 10.255.0.2 on 10.255.0.0/30, 10.255.0.6 on 10.255.0.4/30, 10.255.0.9 on 10.255.0.8/30.
| Destination | Routes that match | Winner (longest) | Result |
|---|---|---|---|
| 10.2.0.200 | /25, /24, /8, /0 | 10.2.0.128/25 | via 10.255.0.6 |
| 10.2.0.77 | /24, /8, /0 | 10.2.0.0/24 | via 10.255.0.2 |
| 10.7.3.4 | /8, /0 | 10.0.0.0/8 | via 10.255.0.9 |
| 10.1.0.9 | /24 connected, /8, /0 | 10.1.0.0/24 | deliver on eth0 |
| 172.16.5.5 | /0 | 0.0.0.0/0 | via 10.255.0.9 |
The deciding step for the first two rows is the /25. Its mask is 255.255.255.128, and the last octet matters. For 10.2.0.200: 200 = 11001000, AND with 128 = 10000000 gives 10000000 = 128, which equals the route’s 128, so it matches. For 10.2.0.77: 77 = 01001101, AND with 128 gives 0, which is not 128, so it does not match and the /24 wins. The edge cases are 10.2.0.127 (last octet 01111111, outside the /25, so the /24) and 10.2.0.128 (inside the /25). A program checking the same table gave the same winners.
Faults That Come From The Table, Not The Network
- A missing return route — the forward path works and the reply is dropped
- An aggregate that covers unused space — the /8 above sends traffic for every unused 10.x address toward 10.255.0.9; if that router’s default points back at this one, such packets bounce until their time-to-live expires (Packet Structure). The owner of an aggregate should discard the part it does not use
- A more specific route that nobody removed — after a link is renumbered, an old /25 can still steal part of a /24’s traffic. When a destination is reached by the wrong path, list every route that matches it, not just the one you expected
- Two equal routes with equal metrics — the router picks one of them, and which one is not something to depend on
Common Mistakes
- Reading the table top to bottom — order does not matter, specificity does
- Forgetting the connected networks — they are in the table too, and they are the most specific route for local machines
- Adding a default route to a router with two exits — it chooses one and ignores the other (Static Routing)
What’s Next
- Learn next: Core Protocols — what rides on the routed packets
- Combine with: Firewalls — the filter that sits beside the routing decision