How Routing Tables Work: Understanding Gateway and Next Hop

 A routing table is not a list of destinations. It is a list of directions, and the rule for choosing between them when several apply is more specific than most people realise.

That rule — longest prefix match — governs every forwarding decision made by every router on the internet, billions of times per second. Understanding it properly is the difference between reading a routing table and merely looking at one.

What a Route Entry Contains

Every entry answers one question: for traffic destined to this range of addresses, where should it go next?

The components:

• Destination network and prefix length. Which addresses this entry covers. 10.1.1.0/24 covers 256 addresses; 0.0.0.0/0 covers everything.
• Next hop. The IP address of the adjacent router that should receive the traffic.
• Exit interface. Which local interface to send it out of.
• Metric. How good this path is, according to whichever protocol supplied it.
• Administrative distance. How much the router trusts the source of this entry.

Not every entry has all five. A directly connected network has no next hop, because the destination is reachable without another router.

The One Rule: Longest Prefix Match

When a packet arrives, the router compares its destination against every entry and finds all that match. Frequently several do.

The winner is always the entry with the longest prefix — the most specific one, covering the smallest range of addresses.

Consider a table containing:

• 0.0.0.0/0 via 203.0.113.1
• 10.0.0.0/8 via 10.1.1.1
• 10.5.0.0/16 via 10.1.1.2
• 10.5.3.0/24 via 10.1.1.3

A packet for 10.5.3.77 matches all four. The /24 entry is the most specific, so it wins and the packet goes to 10.1.1.3.

A packet for 10.5.9.20 matches the first three. The /16 wins, and it goes to 10.1.1.2.

A packet for 10.200.1.5 matches the first two. The /8 wins.

A packet for 198.51.100.4 matches only the default route.

The principle in one sentence: specific always beats general, regardless of any other consideration. Metric and administrative distance never override this. They only come into play when two entries have the same prefix length.

This is also the mechanism behind a technique worth knowing — inserting a more specific route to override general routing for particular traffic, without touching anything else.

The Default Route

The entry 0.0.0.0/0 matches every possible address, with the shortest possible prefix. It therefore loses to every other entry and wins only when nothing else matches.

It is often labelled the gateway of last resort, which describes its function precisely: the direction to send anything the router does not otherwise know about.

In most networks this points toward the internet. A branch office router typically has directly connected routes for its own networks, a handful of specific routes for other company sites, and a default route sending everything else to the firewall.

Without a default route, a router receiving a packet for an unknown destination discards it and returns a destination unreachable message. That is the correct behaviour, and it is also a common cause of the symptom "internal works, internet does not."

Next Hop Versus Exit Interface

A route can specify where to send traffic in two ways, and the difference matters.

Next hop address. "Send this to 10.1.1.2." The router must then determine how to reach that address, which requires another lookup.

Exit interface. "Send this out GigabitEthernet0/1." Direct, with no further resolution needed.

On a point-to-point link, specifying the interface alone works, because there is only one possible recipient. On a shared segment such as Ethernet, specifying only the interface causes a problem: the router does not know which of potentially many devices on that segment should receive the traffic, so it must ARP for every destination it forwards. This produces a large ARP table and unnecessary traffic.

The practical guidance: on Ethernet, always specify the next hop address. Specifying both together is also valid and is the most explicit option.

Recursive Lookup

When a route specifies a next hop, the router performs a second lookup to determine how to reach that address. This is recursive resolution, and it occasionally produces confusing failures.

If a route says "10.5.0.0/16 via 192.168.99.1" and there is no route to 192.168.99.1, the route is unusable. Depending on the platform it may not install in the table at all, or it may install and silently discard traffic.

The symptom is a route that appears correct in the configuration and does not work. The check: confirm the next hop itself is reachable before investigating anything else.

Administrative Distance

A router may learn about the same network from several sources at once — a static route someone configured, plus a dynamic route from a routing protocol. Both have the same prefix length, so longest prefix match cannot break the tie.

Administrative distance does. It expresses how much the router trusts each source, and lower is more trusted. The commonly used values:

• 0 — directly connected. Nothing beats seeing it yourself.
• 1 — static route. An administrator said so.
• 20 — external BGP.
• 90 — internal EIGRP.
• 110 — OSPF.
• 120 — RIP.
• 170 — external EIGRP.
• 200 — internal BGP.
• 255 — considered unreachable and never used.

Only the winning route is installed in the forwarding table. The others are held in reserve and installed automatically if the preferred one disappears.

This enables a useful technique: a floating static route. Configure a backup path as a static route with an administrative distance deliberately set higher than the dynamic protocol's — say 200. Under normal conditions the dynamic route wins and the static sits unused. If the primary path fails, the static route installs automatically and traffic continues over the backup.

Metric

Where two routes come from the same source with the same prefix length, metric decides. Lower is better, and each protocol calculates it differently — hop count for RIP, a cost derived from bandwidth for OSPF, a composite value for EIGRP.

Metrics are only comparable within a single protocol. An OSPF cost of 10 and a RIP metric of 10 have no relationship to each other, which is precisely why administrative distance exists to arbitrate between protocols first.

Reading a Routing Table

The commands differ by platform; the information is the same.

• Windows: route print, or netstat -rn. Also shows interface metrics, which determine adapter preference on multi-homed machines.
• Linux: ip route show, or the older route -n.
• macOS: netstat -rn.
• Cisco: show ip route. To check a specific destination, show ip route 10.5.3.77 displays exactly which entry would be selected — far more reliable than reading the full table and applying the matching rules yourself.

That last command is worth committing to memory. It asks the router to perform the lookup and report the result, which removes any possibility of misreading the table.

Where Routes Come From

Every entry in the table arrived by one of three routes, and knowing which changes how you troubleshoot it.

Directly connected. The moment you assign an IP address to an interface and bring it up, the router adds a route for that network automatically. It needs no configuration and cannot be removed while the interface is up. If a connected route is missing, the interface is down — check that before anything else.

Static. An administrator typed it. Predictable, requires no processing, and completely blind to failure. A static route pointing at a path that has gone down stays in the table, confidently sending traffic into a hole. This is the principal weakness of static routing and the reason it suits small, stable networks rather than large or changing ones.

Dynamic. Learned from a routing protocol — OSPF, EIGRP, BGP, or others. Routers exchange information about what they can reach, and the table updates automatically when the topology changes. The cost is complexity, processing, and a protocol to configure and secure.

The practical guidance for a small network: static routes plus a default route are entirely adequate below roughly three sites. Beyond that, the manual effort of maintaining static routes across every device — and the risk of one being forgotten during a change — outweighs the complexity of running a protocol.

One hybrid worth knowing: static routes to null, sometimes called blackhole routes. Pointing a network at a null interface discards traffic for it silently, which is occasionally useful for suppressing traffic to a range you want ignored rather than returned as unreachable.

The Return Path Problem

The most commonly overlooked aspect of routing: the path back is a separate decision, made by different devices, and it may not mirror the path out.

Traffic reaching a destination successfully proves nothing about whether replies will find their way home. Asymmetric routing — where outbound and return traffic take different paths — is normal on the internet and problematic inside networks with stateful firewalls, because a firewall seeing only one direction of a conversation will drop it.

The diagnostic signature: connections that establish and then fail, or traffic that works from one side and not the other. Whenever behaviour differs by direction, examine routing on both ends rather than only the one reporting the problem.

Faults That Recur

• Missing default route, producing internal connectivity with no internet.
• Unreachable next hop, producing a route that looks right and does nothing.
• Overlapping subnets, where longest prefix match sends traffic somewhere unintended.
• Routing loops, visible as TTL expired messages and repeating hops in a traceroute.
• Static routes left behind after a topology change, quietly overriding correct dynamic routing because of their lower administrative distance.
• Asymmetric paths breaking stateful inspection.
• Interface metrics on Windows causing a machine to prefer wireless over a wired connection.

A last piece of practical advice: when a route behaves unexpectedly, do not reason about the table. Ask the device. Every platform has a way to query which entry would be selected for a given destination, and that answer is authoritative in a way that your interpretation of a routing table is not.