When a router receives a packet, it doesn’t just glance at the destination address and pick whichever route looks close enough — it runs a specific, hierarchical process to find the single best match. Understanding that hierarchy, and the terminology Cisco uses to describe it, is essential CCNA and CCNP material that goes a level deeper than simply knowing what a route entry contains.
What Makes a Route the “Best” Route
The best route is the longest match to a packet’s destination IP address — the route with the greatest number of matching leftmost (left-to-right) bits between the packet’s destination and the route’s network address. The router determines this using the subnet mask stored with each routing table entry, since the packet header itself never carries a subnet mask — that information only exists in the router’s own table.
Take a router with three possible routes to the same general address space: 172.16.0.0/16, 172.16.1.0/24, and 172.16.2.0/24. A packet arrives destined for 172.16.2.100. All three routes technically cover that address, but 172.16.2.0/24 matches the most bits — 24, compared to 16 for the broader /16 route — so it’s selected as the best route, and the packet is forwarded out whatever interface that specific entry points to. For any route to be considered a match at all, the destination address must match at least as many leading bits as that route’s own subnet mask specifies.
The Routing Table’s Hierarchical Structure
Cisco IOS organizes the routing table hierarchically to make this lookup process fast, even on a router holding many thousands of routes. Four terms describe that hierarchy:
- Ultimate route
- Level 1 route
- Level 1 parent route
- Level 2 child route
Ultimate Route
An ultimate route is any route that contains either a next-hop IPv4 address or an exit interface — in other words, enough information for the router to actually forward a packet without needing to consult any other route first. Directly connected routes, dynamically learned routes, and locally configured routes are all ultimate routes, since each one gives the router a complete, actionable path.
Level 1 Route
A Level 1 route is any route whose subnet mask is equal to or less specific than the classful mask that would normally apply to that network address. Level 1 routes can come from a directly connected network, a static route, or a dynamic routing protocol. Because a Level 1 route always contains enough forwarding information on its own, every Level 1 route is also an ultimate route. There are three types:
- Network route — a route whose subnet mask exactly matches the classful mask for that network address.
- Default route — the static catch-all route, 0.0.0.0/0, used for any destination not otherwise found in the table.
- Supernet route — a route whose mask is less specific than the classful mask for that address — the CIDR-based summarization technique covered in more detail in the CIDR and supernetting guide.
Level 1 Parent Route
A Level 1 parent route is a Level 1 network route that has been subnetted — meaning smaller, more specific subnets exist beneath it in the routing table. Critically, a parent route can never be an ultimate route on its own. It doesn’t contain a next-hop or exit interface itself; it exists purely as a heading, summarizing the classful network address, how many subnets exist beneath it, and how many distinct subnet masks those subnets use.
Level 2 Child Route
A Level 2 child route is a specific subnet of a classful network address, sitting beneath its Level 1 parent route in the hierarchy. A single Level 1 parent route can have several Level 2 child routes beneath it — for example, a parent route for 10.0.0.0 might have two child subnets, while a parent route for 172.16.0.0 might have three. Level 2 child routes can be sourced from a directly connected network, a static route, or a dynamically learned route, and — unlike their parent — Level 2 child routes are genuine ultimate routes, since each one carries real forwarding information.
The Route Lookup Process, Step by Step
When a router receives a packet, it examines the packet’s header, extracts the destination IPv4 address, and works through a defined three-step lookup process to find the best match.
Step 1 — Check Level 1 network and supernet routes. The router first compares the destination address against every Level 1 network route and Level 1 supernet route in the table, looking for the best match.
- If the best match found here is a Level 1 network route, an ultimate route, or a supernet route, the router forwards the packet immediately using that route.
- If the best match instead turns out to be a Level 1 parent route, the router doesn’t forward yet — a parent route has no forwarding information of its own, so the process continues to Step 2.
Step 2 — Check the parent route’s Level 2 child routes. The router examines the Level 2 child routes belonging to that Level 1 parent route, looking for a more specific match among them.
- If a matching Level 2 child route is found, the router forwards the packet using that specific child route.
- If none of the child routes match, the process continues to Step 3.
Step 3 — Fall back to remaining Level 1 supernet and default routes. The router checks any remaining Level 1 supernet routes in the table, including the default route, for a match.
- If a match is found here — a broader supernet route or the default route itself — the router uses it to forward the packet.
- If no match exists anywhere in the table, not even the default route, the router drops the packet.
This three-step structure is exactly why the parent/child hierarchy exists in the first place: it lets the router narrow its search quickly, checking a general parent entry before drilling down into its specific subnets, rather than scanning every single route in a flat, unstructured list.
Worked Example: Walking Through All Three Steps
Consider a routing table containing these entries:
172.16.0.0/16 is subnetted, 3 subnets
D 172.16.1.0/24 [90/2172416] via 10.10.10.2
D 172.16.2.0/24 [90/2172416] via 10.10.10.3
D 172.16.3.0/24 [90/2172416] via 10.10.10.4
S* 0.0.0.0/0 [1/0] via 10.10.10.1Here, 172.16.0.0/16 is subnetted, 3 subnets is the Level 1 parent route — notice it has no next-hop or interface of its own, exactly as expected for a parent route. The three D entries beneath it are its Level 2 child routes, each a genuine ultimate route with its own next hop. The S* entry is a Level 1 route — specifically the default route.
A packet destined for 172.16.2.50 triggers Step 1: the router finds the 172.16.0.0/16 parent route is the best available match at this stage, but since it’s a parent route with no forwarding information, the lookup proceeds to Step 2. There, the router checks the three Level 2 child routes and finds 172.16.2.0/24 matches — so the packet is forwarded via 10.10.10.3.
A packet destined for 203.0.113.5, by contrast, doesn’t match the 172.16.0.0/16 parent route at all in Step 1, so there’s no reason to check its children in Step 2. The process falls through to Step 3, where the only remaining match is the default route, and the packet is forwarded via 10.10.10.1.
Recognizing This Hierarchy in show ip route Output
This terminology isn’t just theoretical — it’s visible directly in show ip route output, once you know what to look for. The parent-route line is easy to spot: it’s the one that reads is subnetted, N subnets with no via next-hop information attached, exactly as shown in the worked example above. Every indented entry beneath it, each with its own via and outgoing interface, is a Level 2 child route.
Routes that appear without any parent heading above them — a standalone default route, or a standalone supernet route not associated with any subnetted parent — are Level 1 routes displayed on their own, since they don’t need a parent heading to organize them. Recognizing this pattern at a glance is a useful skill when reading a real, unfamiliar routing table: a parent line tells you at once that everything beneath it belongs to the same classful network, which is often faster than manually comparing every prefix length line by line.
Frequently Asked Questions
What is the best route in a Cisco routing table?
The best route is the longest match to a packet’s destination IP address — the route whose network address shares the greatest number of matching leftmost bits with the destination, as determined by that route’s subnet mask. When several routes could technically cover the same destination, the router always selects the most specific one available rather than a broader, less specific match, since a longer prefix represents a more precise description of where that traffic actually needs to go.
What is the difference between an ultimate route and a Level 1 parent route?
An ultimate route contains enough information — a next-hop address or an exit interface — for the router to forward a packet immediately, and includes directly connected, static, and dynamically learned routes. A Level 1 parent route, by contrast, can never be an ultimate route on its own; it exists purely as a summarizing heading for a classful network that’s been subnetted, with no forwarding information of its own, which is why the lookup process has to drop down into its Level 2 child routes to actually find a usable path.
How does the three-step route lookup process work?
The router first checks Level 1 network and supernet routes for a match, forwarding immediately if it finds an ultimate or supernet route. If the best match at that stage is a parent route instead, the router moves to Step 2 and searches that parent’s Level 2 child routes for a more specific match, forwarding via whichever child route matches. If no child route matches either, the router falls back to Step 3, checking any remaining Level 1 supernet routes and the default route, and only drops the packet if none of those three steps produces any match at all.
Why can’t a Level 1 parent route ever be used to forward a packet directly?
A Level 1 parent route exists purely as an organizational heading in the routing table, summarizing a classful network address along with how many subnets and subnet masks exist beneath it — it was never assigned a next-hop address or exit interface of its own. Forwarding requires an ultimate route, and by definition a parent route isn’t one, which is exactly why the lookup process has a dedicated second step specifically for searching a parent route’s Level 2 children once that parent has been identified as the closest available match.
What happens if a packet’s destination doesn’t match any route in the table?
If the router works through all three steps of the lookup process — Level 1 network and supernet routes, then Level 2 child routes if a parent route was matched, then any remaining supernet or default routes — and still finds no match anywhere, including no default route configured, the packet is dropped. This is exactly why configuring a default route matters so much on a router with a single upstream path: without one, any destination not explicitly covered by a more specific route has no fallback and is simply discarded rather than forwarded somewhere reasonable.
