How a Cisco Router Chooses a Route: Longest Prefix, then AD, then Metric

A Cisco router picks the route for a packet by applying three tests in a fixed sequence. First, the longest prefix match: among all entries whose network covers the destination address, the one with the most mask bits wins. Only if that test leaves a tie, meaning two sources offer the identical prefix and the identical prefix length, does the router compare administrative distance and install the entry from the more trusted source. Metric is the last test and applies only inside a single routing protocol, once that protocol has already won.

The order matters more than any individual rule, because reversing the first two tests is the most common route-selection error a candidate makes. Drilling it until the sequence is automatic pays off under the linear delivery format and the ninety-second decision it forces, since a submitted answer here cannot be revisited.

The longest prefix test

Every entry in the routing table describes a range of addresses. A packet’s destination frequently falls inside several of those ranges at once, and the router must choose one. The rule is specificity: more mask bits means a smaller, more precisely aimed range, and the smallest matching range wins.

Consider a router holding these four entries, read with the line format of the routing table in mind:

S*    0.0.0.0/0 [1/0] via 203.0.113.1
D     10.0.0.0/8 [90/3072] via 10.1.1.2, 1d04h, GigabitEthernet0/1
O     10.30.0.0/16 [110/12] via 10.1.1.6, 02:41:19, GigabitEthernet0/2
S     10.30.5.0/24 [1/0] via 10.1.1.10

Destination address	Entry used	Reason
10.30.5.7	10.30.5.0/24	Matches all four; 24 mask bits is the longest
10.30.9.4	10.30.0.0/16	Outside the /24, so 16 bits is the longest match
10.55.1.1	10.0.0.0/8	Only the /8 and the default cover it
198.51.100.20	0.0.0.0/0	No specific entry covers it, so the default route applies

The default route is the shortest possible prefix, zero mask bits, which is why it is the last resort rather than a special case: it matches everything and therefore always loses to any entry that also matches.

The test is applied per packet at forwarding time, against the table as it stands. It never removes entries; a /24 and a /8 covering the same space coexist happily, each serving the destinations for which it is the most specific match.

Where administrative distance enters

Administrative distance is consulted only when the longest prefix test cannot separate two candidates. That happens when two different sources offer the exact same prefix with the exact same mask, for example OSPF and EIGRP both presenting 10.30.0.0/16. There is nothing to distinguish them by specificity, so the router installs the entry from the source with the lower distance value and leaves the other as a standby candidate. Deliberately raising a static route’s distance so that it waits in exactly that standby position is the floating static route technique.

Two consequences follow, and the exam leans on both.

A longer prefix from a less trusted source still wins. If RIP (distance 120) supplies 172.16.8.0/24 and a static route (distance 1) supplies 172.16.0.0/16, a packet bound for 172.16.8.19 leaves via the RIP entry. The static route is far more trusted, and it is irrelevant, because the two entries are not competing. They describe different destinations, both are installed, and the /24 is the more specific match for that address. Trust only decides who owns a prefix; specificity decides which prefix a packet uses.

Distance is never compared across different prefix lengths. No amount of trust promotes a summary route over a longer, more specific one, and no configured distance value changes the ordering of the tests.

The full table of default values and the reasons sources are ranked as they are is covered in the article on administrative distance.

Where metric enters

Metric is the third test and has the narrowest scope. Once a single source has won a prefix, that protocol’s own metric decides among the multiple paths it knows for that prefix. OSPF compares cost, EIGRP compares its composite value, RIP compares hop count, and the lowest wins.

Metrics are never compared between protocols. An OSPF cost of 12, an EIGRP composite of 3072, and a RIP hop count of 2 are computed on incompatible scales, and treating the smallest number as the best path across sources is meaningless. This is precisely the gap administrative distance was created to fill.

Equal-cost load balancing is a consequence of the metric test, not a fourth test. When one protocol offers several paths to the same prefix with identical metrics, the router installs them together and shares traffic across them. Paths from two different protocols, or with two different distance values, can never be installed together, because one of them lost an earlier test.

Route age and next-hop count

Neither is a selection criterion. The timestamp on a routing table entry records how long the entry has been in place, and a route is replaced by a better candidate without regard to which arrived first. The number of usable next hops is likewise counted after selection, when equal-cost paths from the winning source are installed, and never used to choose between candidates.

Recursive lookups

A route that names only a next-hop address forces a second lookup. The router finds the entry for the destination, reads the next hop, and then looks up that next-hop address in the same table to learn which interface reaches it. The second lookup obeys the same longest prefix rule. If the next-hop address itself resolves only to the default route, the original entry is generally not installed, which is why a static route pointed at an address the router cannot otherwise reach quietly fails to appear. Naming an exit interface instead avoids the second lookup, and the two forms are compared in next hop versus exit interface static routing.

How the 200-301 exam tests this

• Which entry forwards this packet. A table with overlapping prefixes plus one destination address. Count mask bits on every entry that covers the address and take the largest. Distances and metrics in the brackets are deliberately arranged so that reading them first leads to the wrong answer.
• The tie-break question. Two protocols offer the same prefix at the same length and you are asked what is compared next. Administrative distance. Metric, route age, and next-hop count are the standard distractors, and each is wrong for a different reason worth being able to state.
• Specific versus trusted. A stem places a static route at a short prefix against a dynamic route at a long prefix. The dynamic entry carries the traffic for addresses inside its range.
• Why cross-protocol metrics are not compared. Definition items ask what administrative distance is for. The answer rests on metric scales being incompatible between protocols.

The order of tests is the entire topic, and the only way to know it survives pressure is to put it under some — timed practice exams do exactly that.

Quick reference

• Order of tests: longest prefix match, then administrative distance, then metric.
• The longest prefix test runs per packet, against installed entries, and is decided purely by mask length.
• Administrative distance breaks a tie only when prefix and mask are identical.
• A /24 from RIP beats a /16 from a static route for an address inside the /24.
• Metric is compared only within one protocol, after that protocol has won the prefix.
• Equal-cost load balancing requires the same source, the same distance, and the same metric.
• Route age and the number of next hops are never selection criteria.
• 0.0.0.0/0 has zero mask bits and therefore loses to every other matching entry.