Here is a router's table and one address. Which line does the router use?
The tempting answer is the first matching line. It is wrong. A router uses the longest matching prefix — the line that matches the most bits of the address — wherever it sits in the table. Put the default route at the top and the router still prefers the /24 further down.
Which line does the router use for
10.0.19.96?
| Prefix | Netmask | Next hop | For | Covers |
|---|---|---|---|---|
192.168.0.0/16 |
255.255.0.0 |
guest Wi-Fi | The network that has to log every device. | 65,536 addresses |
203.0.113.0/24 |
255.255.255.0 |
documentation range | TEST-NET-3, so it is a safe example. | 256 addresses |
172.16.0.0/12 |
255.240.0.0 |
DMZ | The machines the internet is allowed to reach. | 1,048,576 addresses |
0.0.0.0/0 |
0.0.0.0 |
the internet | Everything else. It matches every address, so it only wins when nothing else does. | every address |
10.42.7.0/24 |
255.255.255.0 |
server farm | The servers, inside the data centre /16. | 256 addresses |
10.42.7.128/25 |
255.255.255.128 |
quarantine VLAN | Half of the server farm, cut off. | 128 addresses |
10.0.0.0/8 |
255.0.0.0 |
corporate network | Everything the office router owns. | 16,777,216 addresses |
10.42.0.0/16 |
255.255.0.0 |
data centre | The rack row, inside the corporate /8. | 65,536 addresses |
Pick the line the router would use.
Streak —
Best today — · all time —
Kept in this browser only; the server never sees a score.
The address in bits
The dark part is matched by the winning prefix; the rest is the host part.
The address 10.0.19.96 is 00001010000000000001001101100000 in binary. 10.0.0.0/8 matches the first 8 of those bits, so it matches the address. 0.0.0.0/0 also matches it, but it only matches 0 bits, and a router prefers the line that matches the most. That is longest prefix match: the /8 wins because it is longer, not because it came first.
Longest prefix match: among the lines whose prefix contains the address, use the one with the most bits in its prefix. The order of the table does not matter.
It is the rule that makes the internet work. A default route matches every address with zero bits of specificity, so a more specific line always beats it — which is how a single /8 can be carved into thousands of smaller networks and each one still reach the right place. It is also why a routing table is usually written from the most specific route to the least, for the reader's benefit and not the router's.
Two rules that are not longest prefix match, and are worth knowing because they are what people actually mean when they say "the first match":
And one thing that is not a routing rule at all: a long prefix is not a better prefix. A /32 line and a /0 line are equally valid; the difference is only how many addresses each one claims.
This is the daily round, the same for everyone on
2026-10-23. /prefix.htm?p=1, ?p=2,
?p=3 … walk through the tables one at a time.
Like this one? Subnet Sweeper is the same bit arithmetic without the routing, Public or Reserved? asks about the address space itself, and the traceroute globe shows what a real path looks like.