Routing Fundamentals

Routing is just deciding where a packet goes next. The router looks at the destination, finds the most specific route it has that matches, and hands the packet to the next hop. That's it. The complicated part is everything that decides which routes end up in the table, and most of my routing headaches come down to not understanding that well enough.

What's in a routing table

Each route is basically:

Destination prefix: what it matches, like 192.0.2.0/24.
Next hop: the neighbor that gets the packet.
Outgoing interface: which port it leaves on.
Source: connected, static, OSPF, BGP, and so on.
Preference and metric: tiebreakers when there's more than one option.

Connected routes show up on their own when an interface is up with an address. Static routes are ones you typed in. Dynamic routes come from routing protocols.

How a route gets picked

This trips people up because there are several decisions stacked in order:

Longest prefix match. The most specific route wins, period. A /24 beats a /16 for an address that matches both, regardless of which protocol it came from.
Administrative distance / preference. If two sources offer the exact same prefix, the router trusts one source over the other (static over OSPF, for example).
Metric. Same prefix, same protocol? Now the protocol's own metric decides.
Equal cost. Still tied? The router may install both and share the load.

Remember: a default route never overrides a more specific one. It's only used when nothing else matches. If traffic isn't following your shiny new default route, go look for a more specific route that's catching it first.

Static and default routes

For small, predictable networks, static routes are great. They're also handy for special cases you don't want depending on a routing protocol. Same two routes on three platforms:

Cisco IOS

ip route 10.20.0.0 255.255.0.0 192.0.2.2
ip route 0.0.0.0 0.0.0.0 198.51.100.1

Linux

ip route add 10.20.0.0/16 via 192.0.2.2
ip route replace default via 198.51.100.1

VyOS

configure
set protocols static route 10.20.0.0/16 next-hop 192.0.2.2
set protocols static route 0.0.0.0/0 next-hop 198.51.100.1
commit
save

The catch with static routes is that they don't know when the world changes. The next hop can be dead and the route will happily stay in the table. If you need automatic failover, add tracking or health checks, or use a dynamic protocol.

Dynamic routing protocols

Protocol	Where you'll see it	What it cares about
OSPF	Enterprise, campus, internal provider networks	Shortest path by interface cost
IS-IS	Big provider networks and data-center underlays	Link-state routing that scales well
BGP	The Internet, routing between organizations, modern data-center fabrics	Policy and path attributes, not just distance
RIP	Legacy gear and tiny networks	Hop count

Don't add a routing protocol just because you can. A small office with one router doesn't need one. A hosting network with redundant routers, a couple of upstreams, and lots of routed subnets almost certainly does.

Policy: when shortest isn't what you want

Real networks often need to route based on rules, not just distance. Things like:

Prefer one transit provider for outbound traffic.
Keep the backup link idle unless the primary dies.
Send management traffic over its own network.
Make sure customer routes never leak into the core.
Push certain traffic through a firewall first.

You can do this with route maps, prefix lists, protocol attributes, policy-based routing, or separate routing tables (VRFs). One warning about policy-based routing: it's powerful, but it makes the routing table lie to you. The table says one thing and the traffic does another. If you use it, document it well.

Redundancy, first-hop protocols, and ECMP

Two routers don't automatically make a redundant network. You need to think through what happens to the gateway addresses, routes, and sessions when one of them dies.

First-hop redundancy: HSRP or VRRP gives hosts a gateway address that survives a router failure.
Dynamic routing: pulls dead paths out and installs the alternatives.
ECMP: uses several equal-cost paths at the same time.
BFD: notices a dead path much faster than normal routing timers do.

One thing to watch: fast convergence only helps if everything around it can handle it. Stateful firewalls, NAT, and asymmetric paths can still drop sessions even when the routing table fixes itself almost instantly.

How I troubleshoot routing

Double-check the destination address and prefix. Typos happen.
Look up the most specific matching route in the local table.
Make sure the next hop is actually reachable on a connected network.
Check that ARP or IPv6 neighbor discovery can resolve the next hop.
Check the return path. Forgetting the way back is one of the most common routing mistakes there is.
Look for ACLs, firewall rules, NAT, or policy routing that's changing the path.
Use traceroute and packet captures to find exactly where it stops.

The commands I reach for, Cisco first, then Linux:

show ip route 203.0.113.25
show ip cef 203.0.113.25 detail
show arp
traceroute 203.0.113.25

ip route get 203.0.113.25
ip neigh show
tracepath 203.0.113.25

ip route get is underrated. It tells you exactly which route Linux would use for that address, including source address and interface.

Last Modified: October 12, 2026, 11:41 am

NightFox