finding the matching route

Hi Everyone,

I'm a bit stuck on route selection. I understand so far that a router will choose the most specific route for any packet. One thing I can't understand though is a question I have seen.

If a router has the following paths:

10.3.0.0/20
10.3.0.0/23

Which two of the following routes will the router choose as the most specific:

10.3.65.43
10.3.1.199
10.3.15.20
10.3.20.30

So I first started by working out the /20 and /23 networks,

For the /20 I would be going up in blocks of 16:

10.3.0.1 - 10.3.15.254
10.3.16.1 - 10.3.31.254
10.3.32.1 - 10.3.47.254
...
etc

and for the /23 I would be going up in blocks of 2:

10.3.0.1 - 10.3.1.254
10.3.2.1 - 10.3.3.254
10.3.4.1 - 10.3.5.254
...
10.3.14.1 - 10.3.15.255
...
10.3.20.1 - 10.3.21.255

but looking at the routes now, I can see that obviously all four routes will match both routes in the routing table. What I fail to understand and to work out is how do you tell which are the most specific?

I can see that 10.3.1.199 matches the /20 10.3.0.1 - 10.3.1.255 network. But also in the /23 10.3.0.1 - 10.3.15.255 network.

I see that in the /23 you have more networks available and the range is less specific. but the other example of 10.3.15.20 - the answer was 10.3.0.0/20.

The 10.3.15.20 packet is surely more specific to the /23 network though in the range 10.3.14.1 - 10.3.15.254 rather than the /20 of 10.3.0.1 - 10.3.15.254

Apparently the /20 is the more specific though?

Sorry for the long post but I thought I would try and get everything in this one message.

thanks

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

wrwarwick

Is the above an actual question you got from somewhere?

wrwarwick

I believe it is looking for 10.3.1.199 and 10.3.15.20. With the given subnets listed, 10.3.0.0/20 and 10.3.0.0/23, the other two addresses do not fall into those networks. Remember, the subnets listed are for those networks only. 10.3.0.0 255.255.240.0 is one network... you were looking at the range of all the subnets with that mask, thus the addresses fall into multiple networks. It's almost more of a subnetting question.

Not sure if this made sense... Lol

pham0329

alliasneo wrote: »

but looking at the routes now, I can see that obviously all four routes will match both routes in the routing table. What I fail to understand and to work out is how do you tell which are the most specific?

Huh? How does 10.3.65.43, 10.3.15.20, and 10.3.20.30 match the 10.3.0.0/23 route?

It's pretty simple. As you said, the more specific routes wins. The route for 10.3.0.0 states that the first 23 bits must match for it to be used, whereas the 10.3.0.0 only states the first 20 bits must match. If a route satisfy both route, the 10.3.0.0 will be used as it's more "specific".

alliasneo

wrwarwick wrote: »

Is the above an actual question you got from somewhere?

Hi Wrwarwick, yes this was a question I had on a cisco press practice exam but I couldn't understand the answer. I wasn't too sure if it was ok to post this up?

alliasneo

Well I did my subnetting and thought that if you subnetted down the networks going up in stages of 2's ( 10.3.0.1, 10.3.2.1, 10.3.4.2 etc) then these ranges would fall in to these networks?

By from what wrwarwick is saying it's only one specific network?

"10.3.0.0 255.255.240.0 is one network... you were looking at the range of all the subnets with that mask, thus the addresses fall into multiple networks." - Sorry I didn't quite understand this bit?

wrwarwick

alliasneo wrote: »

Well I did my subnetting and thought that if you subnetted down the networks going up in stages of 2's ( 10.3.0.1, 10.3.2.1, 10.3.4.2 etc) then these ranges would fall in to these networks?

By from what wrwarwick is saying it's only one specific network?

"10.3.0.0 255.255.240.0 is one network... you were looking at the range of all the subnets with that mask, thus the addresses fall into multiple networks." - Sorry I didn't quite understand this bit?

10.3.0.0 is the network ID for the specified network with a /20 mask (255.255.240.0). We are not looking at finding the range for all networks with that mask; looking at the ranges you are finding the 10.3.16.0/20, 10.3.32.0/20, 10.3.48.0/20 networks, etc. the question is specific in asking about the first set of ranges, not all ranges with that mask.

So in essence the question seems to be asking what two of the following IP addresses fall into the two given networks. Was the answer I gave above correct?

wrwarwick

Just to add - that seems to be a very strangely worded question.

alliasneo

wrwarwick wrote: »

Just to add - that seems to be a very strangely worded question.

Hey, yes you were correct on those two answers

.

I re-worded the question (just in case) so that might be why it looked odd. I thought I would try and word it as simply as possible.

But yes, I suddenly had an - ahhhhh I see - moment just then when I looked back at the answers.

So. Those two routes that were in the routing table - 10.3.0.0/20 and 10.3.0.0/23 are specifically for the 0 network ranges? and this is why the 10.3.65.43 and the 10.3.20.30 do not fall in to the 0 network range.

yeah I was looking at the ranges for each individual subnet and seeing that every route matched up somewhere and I didn't realise that this was the specific 0 range.

I think it's because I'm not used to looking at large routing tables. So for the 10.3.65.43 packet to be routed the router would have to have a 10.3.48.0/20 or a 10.3.64.0/23 route?

Thanks - this is becoming clear now.

pham0329

alliasneo wrote: »

So for the 10.3.65.43 packet to be routed the router would have to have a 10.3.48.0/20 or a 10.3.64.0/23 route?

Yes, the router would have to have a route that matches 10.3.65.43...whether that be 10.3.48.0/20, or 10.3.64.0/23, or 10.3.65.0/24, or 10.0.0.0/8, etc..

wrwarwick

alliasneo wrote: »

Hey, yes you were correct on those two answers .

I re-worded the question (just in case) so that might be why it looked odd. I thought I would try and word it as simply as possible.

But yes, I suddenly had an - ahhhhh I see - moment just then when I looked back at the answers.

So. Those two routes that were in the routing table - 10.3.0.0/20 and 10.3.0.0/23 are specifically for the 0 network ranges? and this is why the 10.3.65.43 and the 10.3.20.30 do not fall in to the 0 network range.

yeah I was looking at the ranges for each individual subnet and seeing that every route matched up somewhere and I didn't realise that this was the specific 0 range.

I think it's because I'm not used to looking at large routing tables. So for the 10.3.65.43 packet to be routed the router would have to have a 10.3.48.0/20 or a 10.3.64.0/23 route?

Thanks - this is becoming clear now.

Correct, they are specifying the network with the ID of 10.3.0.0. Remember, in a network range we have a network ID, range of usable addresses, and a broadcast address. When looking at CIDR notation the first part (before the /) is usually the network ID (at least when looking at a routing table).

With "most specific" in the question my mind went to an example such as this:

Route Preference - Packet Life

wrwarwick

pham0329 wrote: »

Yes, the router would have to have a route that matches 10.3.65.43...whether that be 10.3.48.0/20, or 10.3.64.0/23, or 10.3.65.0/24, or 10.0.0.0/8, etc..

Going off what I stated above, if the router had the 4 routes listed, it would choose the /24 route, because of the more specific (or longest) prefix. More specific prefixes beat anything else when making routing decisions - AD, metric, etc.