First, the essential ideas
- Route and prefix
- A route describes a destination IP range and a way to reach it. A prefix combines a network value with a length such as 198.51.100.0/24.
- Routing table and forwarding table
- The routing table contains selected routing information. A forwarding table is derived for packet lookup. A configured route may not qualify for installation.
- Longest prefix match
- Among installed routes matching the destination, forwarding selects the most specific prefix: the greatest matching prefix length.
- Administrative distance
- Administrative distance (AD) is Cisco's local preference for a route source when sources compete for the same prefix. Lower is preferred; AD is not path length or a security guarantee.
- Metric
- A metric ranks paths within a routing protocol's rules. Values from unrelated protocols are not generally comparable.
- Next hop and exit interface
- The next hop is the immediate router to receive a forwarded packet. The exit interface is the local port used to reach it; neither must be the final destination.
- Connected and local routes
- A connected route covers an enabled interface's network. A local host route identifies the router's own interface address for local delivery.
- Default and host route
- A default route is /0 and matches any destination not covered more specifically. A host route identifies one address: /32 in IPv4 and /128 in IPv6.
- Null0
- Null0 is a logical discard interface. A selected route to Null0 intentionally drops matching traffic; it is not an unplugged Ethernet port.
- Loopback and console
- A loopback is a software interface used here as a stable test address. A console is the router's direct text-management window, independent of its data link.
Read the table in two stages. First ask why an entry qualified for installation. Then, for one packet destination, compare only the installed matching prefixes. Use the worked addresses to make that distinction concrete before entering the lab's commands.
See the idea
Specificity wins this packet lookup
A /32 for one host can override a working /24 even when its distance is higher.
Find the matches
198.51.100.20 matches the installed /24 and its exact /32.
What this model leaves out: Conceptual route comparison, not a physical topology or captured output. Both entries must be installed; policy-based routing is outside this example.
Full visual explanation and references
Two installed route records match .20: a /24 through R2 and a /32 to Null0. The longer prefix selects the discard for that exact host.
Conceptual route comparison, not a physical topology or captured output. Both entries must be installed; policy-based routing is outside this example.
- Find the matches
198.51.100.20 matches the installed /24 and its exact /32.
www.cisco.com - Choose specificity
The matching /32 is longer, so its Null0 action wins despite AD200.
www.cisco.com - Remove and recheck
After removing the /32, the destination again selects the /24 through R2.
www.cisco.com
One idea at a time
Start with something familiar.
Write the destination 198.51.100.20 at the top of your notes. Under it list every route whose range contains that address. Only then choose the most specific prefix; do not start by circling the smallest number anywhere in the output.
Why learn this?
A route can have a less-preferred administrative distance and still win a packet lookup because it describes a more specific destination. Confusing installation and forwarding can make a deliberate discard look like a mysterious network outage.
An everyday comparison
A directory may have a general office address and a special instruction for one named room. The room-specific entry provides more detail than the building-wide entry.
What happens in a network
The /24 resembles the wider office entry, while the /32 resembles one exact destination. Both records can exist without competing to describe the same-sized range.
Where the comparison stopsThe directory metaphor does not model routing protocol metrics, next-hop resolution or packet loss. Only the actual installed entries determine this lookup.
Follow one worked example
- List matching prefixes before preferences.
For 198.51.100.20, both 198.51.100.0/24 and 198.51.100.20/32 match.
Why: This distinguishes overlap from identical destination prefixes.
- Read bracketed fields correctly.
A hypothetical [200/0] means administrative distance 200 and metric 0, not 200 hops or 200 milliseconds.
Why: Field meanings prevent accidental comparison of unrelated measurements.
- Remove only the intentional host discard.
After adding a /32 to Null0, repeat lookup and ping; remove that exact route and repeat them again.
Why: The controlled difference shows longest-prefix selection without changing cabling or remote configuration.
Your first small task
On paper, compare installed 198.51.100.0/24 via 192.0.2.2 with AD1 and 198.51.100.20/32 to Null0 with AD200. Select the forwarding action for 198.51.100.20 and for 198.51.100.21.
Show a hint
The prefix length is the number after the slash. Match the address first; different prefix lengths are not identical-route competitors.
Check the expected result
The .20 destination selects the /32 discard. The .21 destination does not match that host route and selects the /24 next hop.
Pause and explain it in your own words
Why does the AD200 host route beat the AD1 network route for .20?
Show a hint
Decide whether the two entries describe the same destination prefix or overlapping ranges.
Show the explanation
They are different prefixes and can both be installed. During forwarding, .20 matches both, and /32 is longer than /24. AD does not make a broader route override a more-specific installed route.
Short answer
What should you understand today?
Forwarding uses the longest matching prefix among installed routes. Administrative distance helps choose a route source for the same prefix; protocol metrics rank paths within their own rules. Do not compare a /32 and a /24 by distance and call the lower distance the winner: they can coexist, and the matching /32 is more specific.
Before you begin
Learning targets
- Review IPv4 prefixes and IOS command modes; this lab repeats each mode transition.
- Use the exact isolated CML/IOSv platform and entitlement described below.
- Know that a ping needs a usable reply path and does not prove application performance.
- Identify route code, prefix, mask, next hop, AD, metric and default-route meaning.
- Separate routing-table construction from longest-prefix forwarding.
- Explain connected and local entries without confusing them.
- Predict how a /32 discard route overrides an installed /24.
- Restore only the intentional route change and repeat the same lookup and ping.
Words you will meet
Open a word when you need its meaning. You do not need to memorize the whole list before reading.
Route and prefix
A route describes a destination IP range and a way to reach it. A prefix combines a network value with a length such as 198.51.100.0/24.
Routing table and forwarding table
The routing table contains selected routing information. A forwarding table is derived for packet lookup. A configured route may not qualify for installation.
Longest prefix match
Among installed routes matching the destination, forwarding selects the most specific prefix: the greatest matching prefix length.
Administrative distance
Administrative distance (AD) is Cisco's local preference for a route source when sources compete for the same prefix. Lower is preferred; AD is not path length or a security guarantee.
Metric
A metric ranks paths within a routing protocol's rules. Values from unrelated protocols are not generally comparable.
Next hop and exit interface
The next hop is the immediate router to receive a forwarded packet. The exit interface is the local port used to reach it; neither must be the final destination.
Connected and local routes
A connected route covers an enabled interface's network. A local host route identifies the router's own interface address for local delivery.
Default and host route
A default route is /0 and matches any destination not covered more specifically. A host route identifies one address: /32 in IPv4 and /128 in IPv6.
Null0
Null0 is a logical discard interface. A selected route to Null0 intentionally drops matching traffic; it is not an unplugged Ethernet port.
Loopback and console
A loopback is a software interface used here as a stable test address. A console is the router's direct text-management window, independent of its data link.
Read an entry as several separate facts
An IOS route code identifies its source: C for connected, L for local, S for static and O for OSPF. The prefix and mask describe destinations, not the source host. A via field identifies the next hop; an interface identifies the local exit. Bracketed values commonly show administrative distance followed by metric. Output may also include an age, which is time-related information rather than path quality. Read the displayed legend because additional codes depend on platform and route type.
- Decode fields before comparing values.
- A route-table row is forwarding information, not an end-to-end service receipt.
Connected networks and local addresses are not duplicates
An enabled addressed interface creates a connected network route when its state qualifies, and IOS also represents the router's own address as a local route. A connected /30 says the transit subnet is attached. A local /32 says a packet for the router's precise interface address is delivered locally rather than forwarded to a neighbor. A loopback can provide a software destination without pretending there is a physical host behind it.
- Up/up and the intended address are prerequisites for the connected route.
- Keep a diagram's loopback destination explicit rather than drawing an imaginary endpoint.
Installation compares sources for the same prefix
A routing protocol first uses its own rules to select paths. The routing table then considers eligible candidates for a given prefix, including source preference through AD and next-hop resolution. A lower distance generally wins among competing sources for the identical prefix. Common defaults include connected 0, static 1 and OSPF 110. Changing distance is a local policy decision, not an advertisement of a better path to other routers, and should never be used to hide missing reachability.
- Compare AD only in the correct identical-prefix context.
- A protocol's metric is not interchangeable with another protocol's metric.
Forwarding selects the most specific installed match
Once usable routes are installed, an ordinary destination-based lookup chooses the longest matching prefix. A /32 can override a /24 for one IPv4 address even with a larger AD. A default /0 is the least specific match and is used when no more-specific installed route matches. Without a matching route, ordinary forwarding cannot proceed. This lesson does not add policy-based routing, source routing or other mechanisms that can alter the simple destination-based model.
- A matching route is necessary for forwarding, not proof that every address in its range is in use.
- A default route is not automatically an Internet route.
Resolve the next hop and examine the return path
A next-hop address must lead to an appropriate local forwarding adjacency. The routing entry, interface state and neighbor resolution describe different dependencies. On Ethernet, IPv4 ARP resolves the immediate neighbor's MAC address. A ping response also needs a reverse path to the chosen source. The lab uses R1's connected transit address as the ping source, so R2 already knows how to return through the connected /30.
- Keep configured intent separate from the installed route and actual exchange.
- Do not add a broad default route merely to mask an unresolved next hop.
Use a lookup and a test to close the explanation
A destination-specific show command explains which route the router selects. A packet test asks whether the exchange completes. Pair them before the fault, during the discard and after exact removal. If the predicted behavior is not observed, retain the actual output and inspect overlapping routes or an unintended source. Do not claim the routing table is wrong merely because a ping failed; the table may correctly select a configured discard.
- Document the lookup result and same-target test as separate observations.
- Rollback removes the exact host discard, leaving the known-working /24 intact.
Real-world walkthrough
A specific discard hidden beneath a working summary
In a hypothetical maintenance lab, the network route to 198.51.100.0/24 remains installed and R2's transit address replies. Yet one destination, .20, fails after a change. The responsible operator asks for a destination-specific lookup rather than arguing that the route with the smallest administrative distance must always carry the packet.
- Record the failing destination and source, then verify that the original transit link and next hop still exist.
- List every installed route matching .20, including host routes that a brief table scan might miss.
- Compare prefix lengths before considering same-prefix source preference. Identify whether the selected exit is Null0.
- Remove only the documented temporary /32 discard, not the broader network route or unrelated policy.
- Repeat the exact destination lookup and ping; retain any remaining failure as a separate question.
Guided GNS3 lab
Observe a more-specific host discard
Build two routers, establish reachability to R2's loopback, add one host route to Null0 on R1, observe the predicted lookup change, remove that route and retest. No router runtime or timing is claimed during authoring.
Addressing plan
| Device | Interface | Address | Purpose |
|---|---|---|---|
| R1 | Gi0/0 | 192.0.2.1/30 | Transit and default ping source |
| R2 | Gi0/0 | 192.0.2.2/30 | Immediate next hop and return network |
| R2 | Loopback0 | 198.51.100.20/24 | Final locally terminated destination |
Set up the lab
- Use Cisco Modeling Labs 2.10 with its legally entitled bundled IOSv 15.9M reference image. Record the complete show version release; do not export that image to GNS3. No paid API is involved.
- Create fresh nodes and only the listed links. No External Connector, NAT node, bridge, public uplink or production network is permitted. Leave console access independent of the test data links.
- IOSv examples use GigabitEthernet0/0 and GigabitEthernet0/1. Confirm those exact ports in the workbench and show ip interface brief before configuring; if your image differs, document an explicit port substitution first.
- Decline the initial configuration dialog on a new authorized node, press Enter to reach the prompt, then use enable. Do not bypass unknown credentials. All displayed expected results are predictions, not author runtime.
- Without an entitled compatible image, complete the address and route-selection worksheet only. Mark command execution, packet forwarding and recovery unmeasured.
Inspect R1 before changes
In the isolated CML workbench, select R1, open its Console tab and connect before typing. Start at > or #; use end first if a prior task left configuration mode. Record the complete release and confirm Gi0/0 is the sole cable to R2.
enable
show version
show ip interface briefWhat each command means
enable- Enter authorized privileged EXEC mode to inspect this named router.
show version- Record the actual IOSv release and image before applying the source-reviewed instructions.
show ip interface brief- List interface names and state; confirm the mapped Gi0/0 cable endpoint.
- What you should see
- A fresh compatible R1 has the expected port; do not proceed with an unexplained topology difference.
- Why this step matters
- Mapping the real interface prevents a correct command from being sent to the wrong port.
Configure the first transit endpoint
In the isolated CML workbench, select R1, open its Console tab and connect before typing. Start at > or #; use end first if a prior task left configuration mode. Only configure the single listed port; this lab contains no existing production configuration.
enable
configure terminal
interface GigabitEthernet0/0
ip address 192.0.2.1 255.255.255.252
no shutdown
endWhat each command means
enable- Enter authorized privileged EXEC mode; this does not change the network configuration.
configure terminal- Enter global configuration mode on this named router; accepted changes affect its running state.
interface GigabitEthernet0/0- Select R1's cable port toward R2.
ip address 192.0.2.1 255.255.255.252- Set R1's /30 transit address; the mask leaves .1 and .2 as usable neighbors.
no shutdown- Enable this selected lab interface; the peer must also be running.
end- Return to privileged EXEC; this neither saves nor reverses accepted configuration changes.
- What you should see
- The address is configured; physical/protocol up depends on the completed R2 side.
- Why this step matters
- Both endpoints of the same transit subnet need compatible addresses before remote routing can work.
Build R2 and its destination
In the isolated CML workbench, select R2, open its Console tab and connect before typing. Start at > or #; use end first if a prior task left configuration mode. Confirm Gi0/0 is connected to R1; configure the transit and explicit loopback destination.
enable
configure terminal
interface GigabitEthernet0/0
ip address 192.0.2.2 255.255.255.252
no shutdown
exit
interface Loopback0
ip address 198.51.100.20 255.255.255.0
endWhat each command means
enable- Enter authorized privileged EXEC mode; this does not change the network configuration.
configure terminal- Enter global configuration mode on this named router; accepted changes affect its running state.
interface GigabitEthernet0/0- Select R2's transit cable toward R1.
ip address 192.0.2.2 255.255.255.252- Set the other usable address in the transit /30.
no shutdown- Enable R2's selected Ethernet interface.
exit- Return to global configuration before selecting a separate interface.
interface Loopback0- Create or select the local software test interface.
ip address 198.51.100.20 255.255.255.0- Give R2 the final local destination address in the teaching /24.
end- Return to privileged EXEC; this neither saves nor reverses accepted configuration changes.
- What you should see
- R2 should own both the transit address and the loopback address; record actual state next.
- Why this step matters
- The destination exists on R2 itself, so the diagram and tests need no omitted server.
Install the working network route
In the isolated CML workbench, select R1, open its Console tab and connect before typing. Start at > or #; use end first if a prior task left configuration mode. Add only the route for the loopback's network through the directly connected next hop.
enable
configure terminal
ip route 198.51.100.0 255.255.255.0 192.0.2.2
endWhat each command means
enable- Enter authorized privileged EXEC mode; this does not change the network configuration.
configure terminal- Enter global configuration mode on this named router; accepted changes affect its running state.
ip route 198.51.100.0 255.255.255.0 192.0.2.2- Route the destination /24 through neighboring R2; default static AD is 1.
end- Return to privileged EXEC; this neither saves nor reverses accepted configuration changes.
- What you should see
- The static /24 should install when the transit next hop is resolvable.
- Why this step matters
- A configured command and an installed route are separate facts, so the next step checks both behavior and selection.
Record the destination baseline
In the isolated CML workbench, select R1, open its Console tab and connect before typing. Start at > or #; use end first if a prior task left configuration mode. Do not add the deliberate fault until the destination lookup and ping have a working baseline.
enable
show ip route
show ip route 198.51.100.20
ping 198.51.100.20What each command means
enable- Enter authorized privileged EXEC mode to inspect this named router.
show ip route- Inspect C, L and S entries, prefixes and bracketed values.
show ip route 198.51.100.20- Ask which installed route matches the exact loopback destination.
ping 198.51.100.20- Send a bounded ICMP exchange to R2's loopback using the outgoing transit source by default.
- What you should see
- Expect the /24 through 192.0.2.2 and replies, subject to actual interface and neighbor state.
- Why this step matters
- This records what worked and why before adding a more-specific route.
Add the isolated host discard
In the isolated CML workbench, select R1, open its Console tab and connect before typing. Start at > or #; use end first if a prior task left configuration mode. Change only the one destination's lookup. Null0 is intentionally destructive to this lab flow, never a general production repair.
enable
configure terminal
ip route 198.51.100.20 255.255.255.255 Null0 200
endWhat each command means
enable- Enter authorized privileged EXEC mode; this does not change the network configuration.
configure terminal- Enter global configuration mode on this named router; accepted changes affect its running state.
ip route 198.51.100.20 255.255.255.255 Null0 200- Add a /32 for exactly .20 with AD200 and a discard exit; it is more specific than the /24.
end- Return to privileged EXEC; this neither saves nor reverses accepted configuration changes.
- What you should see
- The /32 should coexist with the /24; its higher AD does not remove the wider route.
- Why this step matters
- The two prefixes are different destinations for installation purposes, revealing the distinction from same-prefix AD comparison.
Observe specificity during the fault
In the isolated CML workbench, select R1, open its Console tab and connect before typing. Start at > or #; use end first if a prior task left configuration mode. Retain the exact selected prefix and exit along with the test result; do not invent the router's error wording.
enable
show ip route 198.51.100.20
show ip route 198.51.100.21
ping 198.51.100.20What each command means
enable- Enter authorized privileged EXEC mode to inspect this named router.
show ip route 198.51.100.20- Inspect the selected host prefix and Null0 exit for .20.
show ip route 198.51.100.21- Inspect the remaining /24 selection for .21; no .21 endpoint is claimed.
ping 198.51.100.20- Repeat the original test while its most-specific route discards traffic.
- What you should see
- Expect .20 to select Null0 and fail, while the .21 lookup still selects R2.
- Why this step matters
- Lookup evidence explains the controlled failure; the comparison does not require inventing a second host.
Remove the exact host fault
In the isolated CML workbench, select R1, open its Console tab and connect before typing. Start at > or #; use end first if a prior task left configuration mode. Restore only the known added discard; leave the working /24 untouched.
enable
configure terminal
no ip route 198.51.100.20 255.255.255.255 Null0 200
endWhat each command means
enable- Enter authorized privileged EXEC mode; this does not change the network configuration.
configure terminal- Enter global configuration mode on this named router; accepted changes affect its running state.
no ip route 198.51.100.20 255.255.255.255 Null0 200- Delete precisely the temporary /32 discard including its distance value.
end- Return to privileged EXEC; this neither saves nor reverses accepted configuration changes.
- What you should see
- The temporary host route should disappear, allowing .20 to match the /24 again.
- Why this step matters
- A targeted inverse protects the rest of the baseline and makes recovery attributable to one change.
Retest and retain the clean lab
In the isolated CML workbench, select R1, open its Console tab and connect before typing. Start at > or #; use end first if a prior task left configuration mode. Compare with the original baseline before stopping the CML nodes. Save the project separately from any claim of startup-config persistence.
enable
show ip route 198.51.100.20
ping 198.51.100.20What each command means
enable- Enter authorized privileged EXEC mode to inspect this named router.
show ip route 198.51.100.20- Confirm the selected route is again the /24 through 192.0.2.2.
ping 198.51.100.20- Repeat the same loopback test after removing the intentional discard.
- What you should see
- Expected recovery is the original route selection and exchange; record actual results and unresolved discrepancies.
- Why this step matters
- A completed change needs both the intended route and the intended traffic behavior, not only accepted removal syntax.
Verify
- Identify R1's connected /30, local /32 and static destination /24 in actual output.
- Explain [distance/metric] without describing either as measured latency.
- Compare .20's baseline /24, fault /32 Null0 and restored /24.
- Retain the same-source same-destination ping results for all three phases.
Troubleshoot
- If the /24 is absent, inspect Gi0/0 state and the 192.0.2.0/30 connected route before adding a default.
- If the baseline ping fails, inspect R2's loopback and transit address; R2 should return to R1's connected source without another static route.
- If the /32 is not selected during the fault, check the exact destination and route mask; do not alter AD values blindly.
- If recovery fails, confirm the exact Null0 route was removed and preserve the original /24 rather than clearing the whole table.
GNS3 does not provide Cisco images. Use software only when the applicable license or entitlement permits that environment. Do not share or redistribute image files. Cisco Modeling Labs is the official alternative; its reference images are licensed for use within CML unless separately licensed. A paper exercise needs no image, but does not establish hands-on competence. Virtual routers do not reproduce physical radios, PoE delivery, hardware forwarding rates or failover timing.
- Remove the temporary host discard and retain the clean two-router project for study.
- Stop the isolated nodes. Do not export licensed images or claim a reboot-persistence test.
Practice set
Answer before you reveal
01What does [110/20] mean in a normal OSPF route row?
The bracket order is distance then metric. A metric's meaning depends on its protocol; it is not directly comparable to an unrelated protocol's value.
02Why can /24 and /32 routes both appear?
Installation can retain both. Forwarding then selects the longest matching prefix for the actual destination address.
03What is the distinction between C and L?
A local host route supports delivery to the router itself. The connected prefix describes the attached subnet used to reach neighbors.
04Why does .21 still select the /24 during the fault?
The lookup chooses from matching prefixes only. Selection of the /24 does not assert that any endpoint currently owns .21.
05Does AD1 prove the route is secure or fast?
A static route can point to an unusable or undesirable path. Operational verification and security policy require independent evidence.
06Why is R2's loopback a complete destination here?
The lesson does not claim a server exists behind R2. Its address plan and diagram explicitly end at the software interface.
Knowledge check
Quiz: prove the reasoning
Keep these
Technical takeaways
- Decode codes and fields before selecting a route.
- Separate installation preference from forwarding specificity.
- Different prefix lengths can coexist in the routing table.
- A host discard can override an otherwise working network route.
- Next-hop reachability and return paths still need verification.
- A successful lookup is not the same as a successful application exchange.