How a Route Gets Into the Table

Two protocols, one destination, and the rule that decides

Step 1 of 2 — understand the idea. Read this first and the packet trace will confirm what you already expect, instead of teaching you two things at once.

What you'll be able to do

▸Explain the difference between the RIB and the forwarding table, and why both exist
▸Apply administrative distance and metric in the right order, and say why the order matters
▸Explain why a less-trusted, more-specific route still wins the packet

Before this lesson — it builds directly on:

How a Packet Crosses a Router

A router learns about destinations from several places at once. Some routes are typed in by a person. Some are learned from neighbouring routers, which talk to each other constantly about what they can reach. Sooner or later two of those sources will describe the same destination differently. One says go left, the other says go right. Both are telling the truth as they see it. The router cannot use both. It needs a rule — decided in advance, applied the same way every time — for whose word to take. Without one, the table would depend on the order things happened to arrive in, and the same network would behave differently every time it restarted.

✗ Common misunderstanding: The route with the best metric is the one that gets used.

Why that's wrong: Metric is the SECOND comparison, not the first. Administrative distance — how much the router trusts the source — is checked before the metric is looked at, and a difference there ends the comparison immediately.

Correct model: Trust first, then cost. A metric only ever decides between routes whose sources are equally trusted, which in practice means routes from the same protocol.

The packets prove it: In the trust-beats-cost trace a static route with metric 500 is installed over an OSPF route with metric 20, and the rejection line on the OSPF route says the distance decided it.

✗ Common misunderstanding: If a route is not in the routing table, the router never heard about it.

Why that's wrong: The routing table shows one winner per prefix. A route can be received, valid and current, and simply have lost the comparison — it is sitting in the RIB as a candidate.

Correct model: Two layers: the RIB holds everything offered, the forwarding table holds what won. `show ip route` is a filtered view of the first.

The packets prove it: In the trust-beats-cost trace the RIB tab shows two rows for 10.0.40.0/24 — one installed, one candidate — while the routing table shows only one.

Watch these fields in the lab: ipv4.destIp

RIBglossary: The Routing Information Base: every route offered by every source, including the ones that lost. Nothing is thrown away, which is what makes failover instant.
Forwarding tableglossary: The result of selection: one winning route per prefix. This is what packets are matched against, and what `show ip route` prints.
Administrative distanceglossary: How much the router trusts a source of routing information. Connected 0, static 1, eBGP 20, OSPF 110, iBGP 200. Lower is more trusted. Compared FIRST.
Metric: A protocol's own measure of how good a path is. Only meaningful inside that protocol, and only consulted when the distance ties. Compared SECOND.

Watch these fields in the lab: ipv4.destIp

✓ Concept check — before you open the packets

These test the idea, not the trace. You should be able to answer them from the explanation above.

A router receives an OSPF route to 10.0.5.0/24 with cost 4, and has a static route to 10.0.5.0/24 with metric 900. Which goes in the forwarding table?

What happens to a route that loses the comparison?

A packet for 10.0.40.30 arrives. The table holds a static 10.0.0.0/16 (distance 1) and an OSPF 10.0.40.0/24 (distance 110). Which route carries it, and why?

Now that you understand the concept, observe how it appears in the packet exchange.

The lab runs a real simulated capture — pause, step, click any packet, and inspect every byte.