Reading show ip route: Code Letters, AD/Metric Brackets, and Next Hops

show ip route prints the IPv4 forwarding table: every destination the router has actually selected, in a fixed line format. Each line begins with a code letter identifying where the entry came from, followed by the prefix, an optional bracket holding administrative distance and metric, the next-hop address, the age of the entry, and the outgoing interface. Learning to read one line completely is enough to answer most routing-table questions, because every field in it means exactly one thing.

Anatomy of a table entry

A typical dynamic entry looks like this:

O        10.30.0.0/16 [110/12] via 10.1.1.2, 02:41:19, GigabitEthernet0/0

Read it in six pieces.

O is the code letter. It identifies the source that put this entry in the table, in this case OSPF.

10.30.0.0/16 is the destination network and prefix length. IOS prints the prefix length here in slash notation even though the configuration commands that create static routes take a dotted-decimal mask.

[110/12] is the administrative distance and the metric, in that order, separated by a slash. The first number is the trust ranking of the source (110 is OSPF’s default), and the second is that protocol’s own cost for this path (an OSPF cost of 12). Reading them in the wrong order produces nonsense such as a metric of 110, which is a favorite distractor.

via 10.1.1.2 is the next-hop address: the neighbor the router hands the packet to. This is a Layer 3 address on a shared subnet, not the destination.

02:41:19 is the age of the entry, counting up. It reports how long the route has been in the table since it was installed or last refreshed, here two hours, forty-one minutes, and nineteen seconds. It is not a countdown toward expiry, not a latency measurement, and not the uptime of the interface. A route can be far younger than the interface carrying it, which is what makes the field useful: a recent timestamp on a route that should have been stable for weeks is evidence of a flap.

GigabitEthernet0/0 is the outgoing interface.

Code letters

The legend at the top of the output lists every code the platform supports. The ones in 200-301 scope:

• C is a connected route, created automatically when an interface has an IPv4 address and is up and up. It has no next hop, so the line reads is directly connected followed by the interface name, and it carries no bracket because a connected route has nothing to compare.
• L is the local route, a /32 for the router’s own interface address, present so packets addressed to the router itself are punted correctly.
• S is a static route, typed by an administrator with either a next-hop address or an exit interface, a choice that changes what the table line shows.
• S* is a static default route. The asterisk means the entry is a candidate default.
• O is OSPF intra-area, O IA is OSPF inter-area, and O E1 and O E2 are OSPF external routes redistributed from outside the OSPF domain.
• D is EIGRP, and D EX is external EIGRP.
• R is RIP, B is BGP, and i is IS-IS.

Connected and local entries are withdrawn the moment the interface loses line protocol, and that withdrawal is what tells the routing protocols to stop advertising the subnet.

Gateway of last resort

Above the entries, IOS prints a line such as:

Gateway of last resort is 198.51.100.1 to network 0.0.0.0

That header names the next hop currently in use for the default route. When no default is present it reads Gateway of last resort is not set, which explains quickly why a router with a full interior routing table cannot reach the internet. The 0.0.0.0/0 entry appears in the body of the output as well, usually as an S* line.

Parent and child lines

When a classful network has been subnetted, IOS groups the subnets under a parent line:

      10.0.0.0/8 is variably subnetted, 5 subnets, 3 masks
C        10.1.1.0/24 is directly connected, GigabitEthernet0/0
L        10.1.1.1/32 is directly connected, GigabitEthernet0/0
O        10.30.0.0/16 [110/12] via 10.1.1.2, 02:41:19, GigabitEthernet0/0

The parent line carries no code letter and is not a route. It is a header announcing that the indented lines are subnets of 10.0.0.0/8, with counts of subnets and distinct masks. Counting it as an installed route inflates every route total you are asked for.

Filtering the output

show ip route accepts a route source keyword, and the filtered output is still real routing table lines with their codes, brackets, next hops, and interfaces:

R2# show ip route static
R2# show ip route ospf
R2# show ip route connected

Supplying an address instead makes the router perform a lookup and describe the winning entry:

R7# show ip route 192.168.144.90
Routing entry for 192.168.144.0/24
  Known via "static", distance 1, metric 0
  Routing Descriptor Blocks:
  * 10.14.0.6
      Route metric is 0, traffic share count is 1

The header always names the prefix that won the lookup, so this form proves which entry carries traffic toward a given host and is the fastest way to see which of several overlapping entries applies. Here a 24-bit static entry won, and because the descriptor block lists a next-hop address with no interface, the route was configured with a next hop alone. Had the default route been selected, the header would read 0.0.0.0/0.

show ip route versus show ip protocols

Two commands are routinely confused because both mention routing protocols. One reports the forwarding table, the other reports the control plane that feeds it.

	show ip route	show ip protocols
What it lists	Installed destinations	Configured routing processes
Code letters, brackets, next hops, uptimes	Yes	No
Networks advertised by a process	No	Yes
Passive interfaces	No	Yes
Distance value a process applies	Only as the first number in an installed entry’s bracket	Yes, on its own Distance: line
Timers and update sources	No	Yes
Routes a process knows but did not win	No	No

Passive interfaces and the configured distance for a process are the two facts that appear in show ip protocols and can never be found in the routing table. A passive interface still has its subnet advertised but sends no updates out, and that state is a process attribute rather than a property of any single route.

Two more commands print no routes at all. show ip route summary reports counts and memory consumption per route source, and show ip interface brief lists interfaces with addresses and status.

How the 200-301 exam tests this

• One line, one field. You are given a single entry and asked what one element means. The timestamp is age since installation, the first bracket number is administrative distance, the second is metric, and the address after via is the next hop rather than the destination.
• Command discrimination. A stem wants only the routes from one source. The answers mix real filtered forms such as show ip route ospf with commands that report on protocols, counts, or interfaces instead of routes.
• Which output holds which fact. Multi-select items ask what appears in show ip protocols but never in the routing table. Passive interfaces and the process distance line are the answers; next hop, exit interface, uptime, and the default route’s next hop all appear in the table.
• Reading a code letter correctly. A C entry means connected with administrative distance 0 and no next hop. Distractors give it the static value of 1 or claim it survives an interface going down.

Reading this table quickly matters most in the simlet and testlet formats, where one topology feeds several questions and the same output has to be interpreted more than once. Reading speed is trainable, and practice questions built around routing-table output are the training.

Quick reference

• Line format: code, prefix, [AD/metric], via next hop, age, outgoing interface.
• Distance is first inside the bracket, metric second.
• The timestamp counts up from installation and is not an expiry timer or a latency figure.
• C and L entries have no bracket and no next hop, and disappear when the interface goes down.
• S* marks the static default route; the gateway of last resort header names its next hop.
• A is variably subnetted line is a header, not a route.
• show ip route <address> names the prefix that actually won the lookup.
• show ip protocols is the only place to see passive interfaces and a process’s configured administrative distance.