Separate route selection from successful forwarding
A routing table question has two different layers of reasoning. First, the router decides which route entry best matches the destination. Second, the router must actually be able to use that selected route—through a reachable next hop or directly connected interface. Students often mix these steps together and lose points.
Use this order every time
The most specific matching route wins
All three entries match 10.20.4.5, but the /16 is the most specific because it fixes more leading bits of the destination. Therefore the /16 route via C wins.
/24 beats /16, /8, and /0
Best answer: use 10.20.30.0/24 via 192.168.10.4.
Why: the destination matches /8, /16, /24, and /0, but /24 is the longest matching prefix.
Change only the destination and the winning route changes
| Destination | Matching routes | Winner | Reason |
|---|---|---|---|
| 10.20.30.55 | /8, /16, /24, /0 | 10.20.30.0/24 | Most specific match |
| 10.20.99.5 | /8, /16, /0 | 10.20.0.0/16 | /24 no longer contains destination |
| 10.99.1.1 | /8, /0 | 10.0.0.0/8 | /16 and /24 do not match |
| 203.0.113.8 | /0 only | 0.0.0.0/0 | No more-specific route exists |
Swipe horizontally to compare the route decisions.
Directly connected destinations do not need a remote router next hop
The router recognizes the destination as being on a directly attached subnet. It forwards toward the connected interface and resolves the destination's local-link address as needed.
Default is a fallback, not a preferred shortcut
A default route such as 0.0.0.0/0 matches every IPv4 destination because it fixes zero network bits. That makes it the least specific possible match.
If a /8, /16, /24, or any other more-specific matching route appears later, that more-specific route wins.
A selected route can still be unusable
The routing lookup is correct: the /24 route wins. But forwarding still fails because the router cannot reach the selected next hop on the connected network.
A next hop may require another routing decision
Some routes specify a next-hop IP that is not directly connected. The router may need to look up how to reach that next hop before it can forward the original packet. This is often called recursive resolution.
One correct forward lookup does not guarantee a working conversation
End-to-end communication depends on both directions. The forward route can be perfect while the reverse path is missing, filtered, or misrouted.
Longest-prefix matching happens before route preference comparisons
If two candidate routes have different prefix lengths, the longer prefix wins regardless of metric or route source. If two routes describe the same prefix length, the router may compare administrative preference, protocol preference, metric, or other implementation-specific rules.
| Routes | First decision | Then |
|---|---|---|
| 10.0.0.0/8 and 10.20.0.0/16 | /16 wins by prefix length | No metric comparison needed between these two |
| Two routes to 10.20.0.0/16 | Same prefix length | Preference/metric may decide |
Swipe horizontally to see the route-selection distinction.
Do not choose the “closest-looking” next-hop address
The /16 route wins even though 192.168.10.2 might look numerically “closer” or simpler. Next-hop addresses do not compete by numeric closeness. Route selection is based on destination prefix matching.
A more-specific route can intentionally override a broad route
The /24 route can intentionally steer only that subnet through Firewall-B while the rest of 10.0.0.0/8 follows Core-A. This is a practical reason longest-prefix matching exists: broad routes provide scale while specific exceptions override them.
A specific route can be more specific—and still be wrong operationally
Suppose 10.20.30.0/24 points to a dead next hop while 10.0.0.0/8 points to a healthy path. The router still selects the /24 because it is more specific. It does not “fall back” to /8 merely because the /24's path is broken unless the routing implementation removes or invalidates that specific route.
A /32 is the most specific IPv4 route possible
A host route can override a subnet route for exactly one destination. This is an excellent changed-fact drill because only one address receives different treatment.
Some selected routes intentionally drop traffic
A routing table can contain a discard or null route used for summarization, loop prevention, or policy. If that route is the longest match, the packet may be intentionally dropped rather than forwarded to a next hop.
Prefix length is really a statement about matching leading bits
A /24 compares the first 24 bits of the destination with the route's network bits. A /16 compares only the first 16. Because /24 fixes more bits, it describes a smaller, more-specific destination set.
Use the artifact pattern to decide what to test next
| Observation | Likely boundary | Best next artifact |
|---|---|---|
| No matching route except default | Routing design / fallback behavior | Routing table and intended topology |
| Correct route selected, next hop unreachable | Local-link/next-hop reachability | ARP/neighbor table, interface/VLAN state |
| Forward path works, replies missing | Return path / policy | Remote routing table, firewall logs |
| Wrong route wins | More-specific route present | Prefix lengths and active routes |
| Two equal-prefix routes differ | Preference/metric selection | Route source, preference, metric |
Swipe horizontally to see the troubleshooting matrix.
Common wrong answers sound plausible because they skip one decision step
- Choosing default before checking for more-specific matches.
- Picking the numerically closest next-hop IP.
- Comparing metrics before prefix lengths.
- Assuming a route entry guarantees next-hop reachability.
- Assuming a correct forward route proves the return path.
- Assuming a connected route proves ARP or VLAN health.
- Assuming a broken specific route automatically falls back to a broader route.
Change one fact and force the answer to change
Drill A
Original: destination 10.20.30.55 → /24 wins. Change destination to 10.20.99.5. New answer: /16 wins.
Drill B
Original: only default matches 203.0.113.8. Add 203.0.113.0/24. New answer: /24 wins.
Drill C
Original: 192.168.5.90 is directly connected. Change interface network to 192.168.6.0/24. New answer: connected route no longer applies.
Drill D
Original: /24 next hop unreachable. Change ARP/neighbor state so next hop resolves. New answer: forwarding failure must be investigated farther downstream.
Follow one packet from lookup to frame creation
This connects Layer 3 route selection with Layer 2 local delivery. The route tells the router where to send the packet next; ARP/neighbor resolution supplies the local frame destination.
Keep routing evidence within its boundary
| Evidence | Supports | Still unproven |
|---|---|---|
| Route table contains 10.20.30.0/24 | Router has an active route entry | Next hop is reachable |
| Longest match is /24 | That route wins lookup | Packet reaches final destination |
| Next hop ARPs successfully | Local delivery to next hop works | Remote routing works |
| Forward ping reaches destination | Some bidirectional IP reachability exists for ICMP | Application port/service works |
| TCP session succeeds | Transport path and listener work | Application logic is correct |
Swipe horizontally to see the evidence boundaries.
Write the answer in four sentences
This format gives both the routing decision and the evidence boundary, which is much stronger than writing only “use the /24.”
Solve the full table, then break one dependency
Determine the selected route for 10.20.30.55, 10.20.30.90, 10.20.99.8, 10.88.1.1, and 203.0.113.8. Then make 192.168.10.5 unreachable and explain why route selection and successful forwarding are now different conclusions.
24 routing-table digital flashcards
Practice longest-prefix matching, defaults, connected routes, next hops, recursive lookups, return paths, evidence boundaries, and distractor rejection.