TechKnowSurge
Cisco CCNA 3.1 Cisco CCNA 3.2 Cisco CCNA 3.3 CompTIA Network+ 2.1 Cisco CCNA 1.10
TechKnowSurge Catalog Videos DEMO: Routing Tables
VideoNetworkFree

DEMO: Routing Tables

Routing tables are structured records that tell a router or host device how to forward traffic based on destination networks, next-hop addresses, and exit interfaces. This content covers how to read both a router routing table and a Windows host routing table, including static routes, directly connected networks, and dynamically learned routes.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

A routing table is the core reference a router uses to make forwarding decisions. Each entry contains a destination network, the method by which the route was learned, and the next-hop IP address or exit interface the router should use to reach that destination. A static default route, represented by 0.0.0.0/0, acts as a catch-all for traffic destined for unknown networks, forwarding packets to a predefined next-hop address. Directly connected networks appear with their assigned interface, and the router also records a host address with a /32 prefix mask for its own interface — known as a link-local address — so it can recognize and respond to traffic addressed directly to itself. Dynamic routing protocols such as RIP allow routers to exchange routing information automatically. When a router learns about a remote network through RIP, the routing table records not only the destination network and next-hop address, but also a timer that tracks how long ago the route was last confirmed. If updates stop arriving, the route can be expired and removed, keeping the table accurate and preventing traffic from being forwarded over paths that may no longer be valid. Variable-length subnet masking means a single major network block can appear across multiple entries with different prefix lengths, which the routing table summarizes for clarity. Host machines, including standard Windows workstations, also maintain routing tables that follow the same fundamental logic. A host routing table includes a default route pointing to the local gateway, a loopback entry at 127.0.0.1 for interface testing, and broadcast addresses the machine is configured to accept. When a VPN client connects, the VPN software installs additional routes into the host routing table, directing traffic for specific remote networks through a virtual interface. Those routes are removed automatically when the VPN disconnects and reinstalled when the connection is reestablished, demonstrating how routing tables dynamically reflect the current state of network connectivity at both the router and endpoint level.

What you'll learn

What's covered

Routing Tables

Aligned to

Cisco CCNA
3.1 Interpret the components of routing table
3.2 Determine how a router makes a forwarding decision by default
3.3 Configure and verify IPv4 and IPv6 static routing
1.10 Verify IP parameters for Client OS
CompTIA Network+
2.1 Explain characteristics of routing technologies

Key terms

Router
A network device that forwards data packets between networks based on IP addresses.
Routing Protocol
A protocol used by routers to communicate and share routing information to determine the best path for data.
Default Gateway
The router that a device uses to send traffic to destinations outside its local network.
Virtual Private Network
VPN
A technology that creates a secure, encrypted tunnel over a public network to protect data in transit.
Routing Table
A database stored in a router that lists known network destinations, the metric (cost) to reach them, and the next-hop address or outgoing interface to forward packets toward those destinations. Routers consult this table for every packet they forward.
Static Route
A routing table entry manually configured by an administrator that specifies a fixed path to a destination network and never changes unless the administrator modifies it. Static routes are simple and predictable but do not adapt automatically to network topology changes.
Default Route
A catch-all routing entry represented as 0.0.0.0/0 (IPv4) or ::/0 (IPv6) that a router uses to forward packets when no more specific matching route exists in the routing table. It is typically configured to point toward the next-hop router or ISP connection.
Next Hop
The IP address of the immediately adjacent router that a packet is forwarded to on the way toward its final destination. A router's routing table entry for each network destination includes the next-hop address so the router knows where to send the packet.
Directly Connected Route
A routing table entry automatically created when an interface is configured and active, representing a network physically attached to the router.
Loopback Address
The reserved IPv4 address 127.0.0.1 (within the 127.0.0.0/8 range) that a device uses to send traffic to itself, allowing the local network stack to be tested without sending packets onto a physical network. Pinging 127.0.0.1 is a quick way to verify that a device's TCP/IP stack is functioning.

Transcript

Reading a router's routing table

We are going to take it from the perspective of this router right here, so the routing table that we see is based off of the routing table that we would see on this machine right here. Let us pick this apart and take a look at what we see.

Number one, the first thing we run across is this S. That just means static. It is a static route that has been entered into this router. The next part of this is a quad zero, or 0.0.0.0/z, which means the whole internet. It is the everything. This is the default route. So somebody has entered a static default route into this machine.

Next we see the next hop. That is specifying the interface on this router right here. The next hop for the default route means that if something comes into this router and the router does not know what network it is or where to send it, then it will use its default route to send it to the next hop IP address of 192.168.0.2.

It also shows that it is directly connected on serial 001. That is the interface on itself, so that is the exit interface to get to that next hop. That is what a static route would look like.

The subnetting summary line

Then we see a little summary here. We can see that it is variably subnetted, so the subnets actually change within here, into three subnets. I can count them: one, two, three. Sure enough, there are three there. And it has two different masks, and I can count it: there is one which is a /24, and there is another which is a /32. Sure enough, that all checks out. So that is the summary of these networks right here.

The directly connected network

The next one we see right here is representative of the network 172.16.1.0. That is this directly connected network right here. It even says it is a directly connected network, and the C stands for connected. This is a network that is connected. It is on gig Ethernet 00, so that is this interface on this router right here. That interface goes into this network, this directly connected network.

So what is the address of that? That shows up on the next line. This 172.16.1.1 is a host address. We see that by a /32, which represents a host address, and it is the interface that is connected to this network. We call this a link local address.

One reason why this is inside of the routing table is because if a packet is destined for this router - let us say you are pinging the default gateway - it comes into the router, the router looks it up on its routing table and sees that this is the link local address, this is my address, and essentially routes it to itself. So yes, it is directly connected, and it is gigabit Ethernet 0000. That is why that shows up there.

The route learned through RIP

Next we see this 172.16.2.0/24. That is this remote network over here. So how did it learn about this remote network over here? It tells you right here: the R. It learned it through RIP. R stands for RIP, so it is using a dynamic routing protocol. What we would assume is that this router and this router are set up to use RIP. They are exchanging information back and forth, exchanging their router tables back and forth, so this router has learned about this network through this router.

In fact, it says via 192.168.0.2. That is where it learned it from. It sees once again this interface, this IP address of this router right here, so it understands where that is.

This is interesting, this is a little different: this is just saying how long it has learned that route for, and it does that for expiration purposes. If the route goes down and does not get an update, then it can expire that route over time.

But for this network the next hop is serial 0000, so it knows it is going to send this out 000 to get it to its next hop IP address.

We have got once again another network. It is subnetted - sure enough, I see a couple of subnets there, and it is two subnets, and we see that it is two subnets there. We have got a 192.168.030. This is the link local and this is the directly connected network, and both of those are on the serial 0000 interface right there.

That is how you would read a routing table.

A Windows host routing table

What is interesting is that host machines on your network will also have a routing table. This is an example of a Windows routing table, and we can get a few pieces of information from this as well. I am not going to cover it all, but what we see here at the top is a default route. Once again we have got quad zeros, and it specifies the gateway of this network - that is the router within this network - and it even has the interface that it will need to exit to get to that gateway. So that all makes sense right there.

We will see that there is a lot of other kinds of associations within here. We see a 127.0.0.1 right here, and we know that is the loopback address. If we want to test this interface, if the interface is up but we are not getting some sort of signal, then maybe we test this out to see if that is functioning correctly.

We see some broadcast addresses that are in here, so that it knows that it can listen to broadcast addresses.

The other thing that I will point out is that we see some 10 networks and we see some 172 networks, but they are all associated with a different gateway. It is this 10.30.0.1, and the interface is a little different also.

Now this is interesting. This actually specifies a VPN connection. The VPN connection is like a virtual interface that is set up on this machine, and then it installs these routes onto this machine. So for these networks, it knows how to get to these networks by going through this virtual interface, this VPN interface, to get to its destination. If I were to disconnect from the VPN, then these routes would come off and you would not see them. If I were to reconnect, then they would come back on. That is how it realizes that there are networks on the other side of this VPN connection, and how it gets that information over to that other side.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →