Routing — forwarding table, routing table: Worked examples

Before we start, let us re-earn the three symbols we lean on the whole page:

The scenario matrix

Think of LPM like the arctan story: the naive move ("just take the first thing that fits") breaks in specific cells, and each cell needs its own picture. Here is the full grid this topic can throw at you.

Cell	What makes it tricky	Covered by
A. Plain nested match	several prefixes match, pick longest	Ex 1
B. Sub-byte boundary ( $/25, /26$ )	the split happens inside a byte, so decimal intuition lies	Ex 2
C. Only default matches	address hits nothing specific	Ex 3
D. Zero / degenerate: `/32` host route	prefix as long as the address itself	Ex 4
E. Two prefixes, same length	LPM ties — routing table (metric/AD) must break it	Ex 5
F. "Contained but not matching"	address is numerically between prefix bounds but LPM sends it elsewhere	Ex 6
G. Real-world word problem	ISP + branch office, resolve next-hop to interface	Ex 7
H. Exam twist: overlapping supernet vs default	`/0` vs a `/1`, limiting behaviour of $L = 0$	Ex 8

Each example below is tagged with its cell.

Figure — Routing — forwarding table, routing table

The figure above is our reading key for the whole page: a 32-bit address is a road of bits; a prefix "claims" the first $L$ of them. Longer claim = pickier = more specific = the winner.

Worked example 1 — Cell A: plain nested match

Steps:

Turn the address' relevant bytes to bits: $172 = 10101100$ , $16 = 00010000$ , $9 = 00001001$ . Why this step? LPM compares bits, not decimal; we must see the bits to judge who matches.
Test /12: mask keeps 12 bits = first byte + top 4 bits of second. $172.16 \to 101011000001$ , and $172.16.0.0/12$ base = same 12 bits. Match ✓. Why? $172.16.9.5 \land 255.240.0.0 = 172.16.0.0 = P$ .
Test /22: mask = 22 ones = 255.255.252.0. Third byte $9 = 00001001$ ; keep its top 6 bits → $00001001$ , top 6 = 000010 = $8$ . So $172.16.9.5 \land 255.255.252.0 = 172.16.8.0 = P$ . Match ✓. Why? $/22$ claims 6 of the third byte's 8 bits; $9$ and $8$ share those 6 bits.
Matches have $L = 0, 12, 22$ . Largest = 22 → eth2. Why? Most specific route knows the destination best.

Worked example 2 — Cell B: the split happens inside a byte

Steps:

Only the last byte differs between the prefixes, so focus there. $200 = 11001000$ . Why this step? A /26 claims 26 bits = all of bytes 1–3 plus the top 2 bits of byte 4. The decision lives in those 2 bits.
/26 mask on last byte: 2 ones then 6 zeros = 11000000 = $192$ . So mask = 255.255.255.192. Why? $L = 26$ means $26 - 24 = 2$ ones in the fourth byte.
$200 \land 192$ : $11001000 \land 11000000 = 11000000 = 192$ . Base of /26 = $192$ . Match ✓. Why? The top two bits of $200$ are 11, same as the top two bits of $192$ .
/24 also matches (10.1.1 agrees). Lengths $24$ vs $26$ → longest = 26 → B.

Worked example 3 — Cell C: only the default matches

Steps:

Test both /24s: first byte $8$ matches neither $192$ nor $198$ . No match. Why this step? If even the first claimed byte disagrees, the AND-equality already fails.
Test /0: mask = zero ones = 0.0.0.0. $8.8.8.8 \land 0.0.0.0 = 0.0.0.0 = P$ . Match ✓. Why? ANDing with all-zeros erases everything, so any $D$ collapses to $0.0.0.0 = P$ . That is why the default matches every address — see Default Gateway and 0.0.0.0/0.
Only match has $L = 0$ → eth9.

Worked example 4 — Cell D (degenerate): a `/32` host route

Steps:

/32 mask = 32 ones = 255.255.255.255. It claims all bits — so a /32 names exactly one host, not a network. Why this step? $32 - 32 = 0$ host bits ⇒ zero-sized "network" ⇒ a single machine. This is the limiting case of "longer mask = smaller network".
Packet 10.5.5.5: $10.5.5.5 \land all-ones = 10.5.5.5 = P$ . Match ✓, $L = 32$ . Also /8 matches. Longest = 32 → B. Why? A /32 is the most specific possible route — nothing can out-specify it.
Packet 10.5.5.6: $10.5.5.6 \neq = 10.5.5.5$ , so /32 fails. Only /8 matches → A. Why? One bit of difference ( $5$ vs $6$ ) breaks a /32 because every bit is claimed.

Worked example 5 — Cell E: two prefixes, SAME length (LPM ties)

Steps:

Note LPM sees identical $L = 16$ for both. LPM is silent on ties. Why this step? LPM compares specificity; equal specificity means we need a different judge — this is a routing-table decision, not a forwarding one.
The routing table applies administrative distance first: OSPF = 110, RIP = 120, lower is more trusted. OSPF wins. Why? Administrative distance ranks how much we trust the protocol — see OSPF and Link-State Routing and Distance Vector — RIP.
Only the OSPF route is installed into the FIB → one entry per prefix, exactly as the parent note promised. Why? The data plane must be unambiguous; per-packet lookup returns one answer.

Worked example 6 — Cell F: "contained numerically" but LPM routes elsewhere

Steps:

10.1.4.250: third byte $4$ = the /24 base's third byte, so /24 claims bytes 1–3 = 10.1.4 and they agree. Match, $L = 24$ . /16 also matches. Longest = 24 → B. Why this step? The host byte $250$ is never tested by /24; only bytes 1–3 are claimed.
10.1.5.9: /24 claims third byte and needs it $= 4$ , but here it is $5$ . /24 fails. /16 still matches (10.1). → A. Why? Being "numerically close" ( $5$ next to $4$ ) is irrelevant — LPM tests exact claimed bits, and $5 \neq = 4$ .

Worked example 7 — Cell G: real-world word problem (next-hop resolution)

Steps:

LPM on 142.250.72.14: not in 192.168.10.0/24 (first byte $142 \neq = 192$ ). Falls to 0.0.0.0/0. → next-hop 203.0.113.1. Why this step? Web address is not local, so the default route (gateway of last resort) takes it.
Resolve the next-hop IP → interface: 203.0.113.1 is reachable on g0/0. So the FIB entry is (0.0.0.0/0 → g0/0, next-hop 203.0.113.1). Why? The data plane needs a physical port, not an IP — this is the route-resolution step from the parent note.
Get the next-hop's MAC via ARP — Address Resolution Protocol, build the frame, ship it out g0/0. Why? Layer-2 delivery on the wire to the next hop needs its MAC; ARP maps IP→MAC. See also IP Addressing and Subnetting.

Worked example 8 — Cell H: exam twist, `/0` vs `/1` (limiting behaviour)

Steps:

A /1 claims exactly one bit: the top bit of the first byte. Base 0.0.0.0/1 = top bit $0$ ; base 128.0.0.0/1 = top bit $1$ (since $128 = 10000000$ ). Why this step? $L = 1$ ⇒ mask = 128.0.0.0. This partitions all $2^{32}$ addresses into "top bit 0" and "top bit 1".
10.0.0.0: $10 = 00001010$ , top bit $0$ → matches /1 A (and /0 C). Longest = 1 → A. Why? Any $L = 1$ beats the $L = 0$ default.
200.0.0.0: $200 = 11001000$ , top bit $1$ → matches /1 B (and /0 C). Longest = 1 → B. Why? Same rule, other half.
Because the two /1s together cover every address, the /0 default (C) is never the longest match here — it is dead code. Why? $L = 0$ is the smallest possible length; it only wins when nothing longer matches, and something longer always does now. This is the limiting behaviour of $L = 0$ .

Recall Rapid re-check across all cells

Default matches every address because ::: ANDing with the all-zero mask collapses any $D$ to $0.0.0.0$ , which equals the prefix. A /32 route names ::: exactly one host (0 host bits), the most specific match possible. LPM ties (same $L$ ) are broken by ::: the routing table using administrative distance, then metric. /25 splits the last byte at ::: 128 — you compare only the top bit(s) of that byte, not the whole decimal value. When two /1 routes exist, the /0 default is ::: never the longest match (it becomes unreachable).

🇮🇳 Prefer Hinglish? 4.3.13 Routing — forwarding table, routing table (Hinglish)