The Routing Table and Longest Prefix Match
A router forwards a packet by comparing its destination IP address against every entry in the routing table and choosing the most specific match, which means the entry with the longest prefix length. A /32 host route beats a /24, which beats a /16, which beats the default route 0.0.0.0/0, regardless of how each route was learned or how good its metric is. Only after specificity is decided does anything else matter. Each entry in show ip route lists the source code (C for connected, L for local, S for static, O for OSPF, D for EIGRP, B for BGP), the prefix, the administrative distance and metric in square brackets, the next hop and the exit interface. A route only appears in the table if its next hop is itself reachable and its exit interface is up, which is why removing an interface silently withdraws the connected, local and any static routes that depend on it.
Exam tip. Given a packet and a routing table, mask the destination against each candidate route and pick the longest match before you look at anything else. This is the single most commonly tested routing skill.
Administrative Distance and Route Source Preference
When two different sources offer a route to exactly the same prefix, the router must choose one to install, and it does so using administrative distance, a measure of trustworthiness where lower is better. A directly connected interface has an AD of 0 and is always believed, a static route has 1, external BGP has 20, internal EIGRP 90, OSPF 110, RIP 120, external EIGRP 170 and internal BGP 200. An AD of 255 means the source is not trusted at all and the route will never be installed. Administrative distance is only ever a tiebreaker between different sources for an identical prefix; if the prefixes differ in length, longest match decides first. You can raise the AD of a static route deliberately so that it sits idle behind a dynamic route and only appears when the dynamic route disappears, which is the floating static technique.
Exam tip. Remember the order of operations. Longest prefix match is decided before administrative distance, so a /24 OSPF route beats a /16 static route even though static has the lower AD.
Static Routing: Default, Network, Host and Floating Routes
A static route is an entry you type manually, and it stays in the configuration until you remove it. The syntax is ip route followed by the destination network, its mask, and then either a next-hop IP address, an exit interface, or both. Specifying only an exit interface works cleanly on point-to-point links but on a multi-access Ethernet segment it forces the router to ARP for every destination, so the fully specified form giving both interface and next hop is the safest. A default route of 0.0.0.0 0.0.0.0 sends everything unmatched towards an upstream router and is the normal configuration on a branch or stub site. A host route uses a /32 mask to reach one specific address, and a floating static route carries a deliberately raised administrative distance so it only installs when the preferred path fails. Static routing is predictable and consumes no CPU or bandwidth, but it does not react to topology change on its own.
Exam tip. On an Ethernet link, a static route with only an exit interface can appear correct and still fail. Expect configuration questions where the fully specified form is the right answer.
Distance Vector versus Link State Routing
Dynamic routing protocols fall into families that differ in what each router knows. A distance vector protocol such as RIP knows only what its neighbours tell it: a list of destinations and how far away they are, so it routes by rumour and relies on techniques such as split horizon, route poisoning and holddown timers to avoid loops. A link state protocol such as OSPF floods link state advertisements so that every router in an area builds an identical database of the whole topology, then each runs the Dijkstra shortest path first algorithm against itself to compute its own tree of best paths. Link state converges faster and scales better but needs more memory and CPU. Protocols are also classified as interior gateway protocols used inside one administrative domain, such as OSPF and EIGRP, or exterior gateway protocols used between them, of which BGP is the only one in use.
Exam tip. Watch the wording. Link state protocols exchange link state advertisements, not routes, and each router calculates its own best paths. Any answer saying OSPF routers exchange complete routing tables is wrong.
OSPFv2 Fundamentals: Areas, Router ID and Adjacencies
OSPFv2 is the link state IGP tested on the CCNA, using protocol number 89 and an administrative distance of 110. Routers in the same area flood LSAs to each other so they hold identical link state databases, and area 0 is the backbone through which all other areas must connect. Each router needs a unique 32-bit router ID, chosen in strict order: the router-id command, then the highest IP on any up loopback interface, then the highest IP on any up physical interface. Neighbours are discovered with hello packets sent to 224.0.0.5 every 10 seconds on broadcast networks, and an adjacency only forms if both routers agree on area ID, hello and dead intervals, subnet, authentication and stub flags. The neighbour relationship progresses through Down, Init, 2-Way, ExStart, Exchange, Loading and finally Full, and getting stuck at 2-Way with a DROTHER neighbour on a broadcast link is normal rather than a fault.
Exam tip. When OSPF neighbours will not form, check in this order: are they on the same subnet, same area, with matching hello and dead timers, matching authentication, and is either interface passive. Duplicate router IDs also block the adjacency.
OSPF Network Types, DR and BDR Election
OSPF adapts its behaviour to the medium underneath it. On a broadcast multi-access segment such as Ethernet, forming a full adjacency between every pair of routers would produce a flood of duplicated LSAs, so OSPF elects a designated router and a backup designated router. All other routers, known as DROTHERs, form full adjacencies only with the DR and BDR and remain in the 2-Way state with each other. The election compares the highest interface OSPF priority, defaulting to 1, and breaks ties on the highest router ID; a priority of 0 makes a router ineligible. The election is not pre-emptive, so a new router with a better priority will not take over until the current DR fails. Point-to-point links, by contrast, need no DR at all because there can only ever be one neighbour, which is why a serial link or a manually configured point-to-point Ethernet forms adjacencies faster and with less overhead.
Exam tip. Setting ip ospf network point-to-point on a two-router Ethernet link removes the DR election and speeds convergence. Expect a question where making an interface priority 0 is the way to stop a router becoming DR.
OSPF Cost, Path Selection and Verification
OSPF measures a path by cost, and the cost of an interface is the reference bandwidth divided by the interface bandwidth, rounded down with a minimum of 1. With the default reference bandwidth of 100 Mbps, a FastEthernet interface has a cost of 1 and so does a gigabit or ten gigabit interface, which means OSPF cannot distinguish between them. The fix is to raise the reference bandwidth consistently on every router with auto-cost reference-bandwidth, or to set ip ospf cost manually on individual interfaces. Total path cost is the sum of the outgoing interface costs from the local router to the destination network, and the lowest total wins. When several paths tie, OSPF installs up to the maximum number of equal-cost paths and shares traffic across them. Verification centres on show ip ospf neighbor for adjacency state, show ip ospf interface brief for cost, area and timers, and show ip route ospf for what actually got installed.
Exam tip. Practise adding interface costs along a path by hand. If a question gives link speeds rather than costs, calculate each cost from the reference bandwidth first, and remember the default reference makes gigabit and faster links indistinguishable.
First Hop Redundancy Protocols: HSRP, VRRP and GLBP
Endpoints usually have a single default gateway address, so if the router holding that address fails, the whole subnet loses its route off the LAN. First hop redundancy protocols solve this by having two or more routers share one virtual IP address and one virtual MAC address, with an active or master router answering for it and a standby taking over within seconds of a failure. HSRP is Cisco proprietary and elects an active router based on the highest priority, breaking ties on the highest IP address, and by default it is not pre-emptive so you generally configure the standby preempt option. VRRP is the open standard equivalent and is pre-emptive by default. GLBP is also Cisco proprietary and goes further by load balancing: a single active virtual gateway hands out different virtual MAC addresses to different clients so several routers forward traffic at once. Interface tracking lets a router lower its own priority when its uplink fails, so control moves before traffic is black-holed.
Exam tip. If a question asks for gateway redundancy plus simultaneous use of both routers without splitting VLANs, the answer is GLBP. If it asks for a multivendor solution, the answer is VRRP.