A Gateway's Routing Table

  Return to Networking Basics Home Page.

Introduction

To forward packets, a router consults its routing table much like a workstation and sends the packet on its way over the appropriate interface. Where a router differs from a workstation is in what sort of traffic it will accept. When routing is enabled in the Linux kernel (also including Solaris, HP-UX, and others), the router will accept packets destined for its Ethernet address, but with IP destination headers pointing somewhere else. A machine without a router might accept these packets from the wire (because of the correct Ethernet address), but would then discard them when it discovered that they were not destined for its IP address. The router knows that its job is to forward, so it accepts the packet and examines its headers to find out where it's headed. A routing table on a router looks like this and is taken from the router depicted in the following figure:

  $ route -n
  Kernel IP routing table
  Destination    Gateway       Genmark          Flags   Metric  Ref    Use  Iface
  192.168.5.20   192.168.10.7  255.255.255.255  UGH     1       0      180  eth1
  192.168.1.81   192.168.10.5  255.255.255.255  UGH     1       0      187  eth1
  192.168.10.0   0.0.0.0       255.255.255.0    U       0       0    63311  eth1
  192.168.18.0   0.0.0.0       255.255.254.0    U       0       0   753430  eth0
  192.168.64.0   192.168.10.5  255.255.192.0    UG      1       0    47543  eth1
  192.168.128.0  192.168.10.7  255.255.192.0    UG      1       0    89011  eth1
  127.0.0.0      0.0.0.0       255.0.0.0        U       0       0      564  lo
  0.0.0.0        192.168.10.20 0.0.0.0          UG      1       0   183436  eth1

We can tell a lot about this router by looking at the routing table (even without the aid of the illustration).

• The first two entries are known as host route; they can be used to access only a single destination IP. This is denoted by the H in the Flags field, and the fact that the Genmask is 255.255.255.255 (or /32). Both of these routes have a metric of 1 and a gateway on teh 192.168.10.0/24 network, which is why the Iface is set to eth1. When the kernel encounters a packet destined for one of these exact IP addresses, it will be forwarded to the specified gateway over the eth1 interface.

• The next entry is just like the entry that a workstation has for its network interface. It is a network route for the locally connected network, 192.168.10.0/24. You can tell this because the gateway is set to 0.0.0.0 (which implies a local interface), and there is a G in the Flags field. We can safely assume that the eth1 interface has an IP address in the 192.168.10.0/24 subnet. The figure confirms this; the interface is 192.168.10.1.

  For those of you familiar with other Unices (other than Linux), this is one point where Linux differs. If does not need to use the IP address of the interface as the gateway for locally connected networks (although this type of configuration will also work). It automatically uses the interface listed in the Iface field. By looking at the figure, we might surmise that the 192.168.10.0/24 network is a network for routers.

• The forth entry is just like the third, except that it is for interface eth0, which we can see is connected to teh 192.168.18.0/23 network. This is the network where the workstations are - the LAN.

• The next two (fifth and sixth) entries are network routes with point out over gateways on the router network. All traffic which falls into IP address ranges denoted by the network address (Destination) and subnet mask (Genmask) will be forwarded to the appropriate WAN router. A safe bet would be that these correspond to IP address space in use in other locations. If you notice their Genmask, you will understand why they first appear now in the routing table. The table is sorted from most-restrictive to least-restrictive, and 255.255.192.0 is the widest subnet mask yet.

• The next to last entry in the table is for the loopback device, lo, just like on a workstation.

• The last entry is the default route. Just like workstations, routers have these in case they do not know where else to forward a packet. In our example, the default route points to the 192.168.10.20 machine, and is heavily used (note the Use field). 192.168.10.20 could be the Internet router or firewall.

Preference for Two Equivalent Routes

Note that the table is sorted in reverse order by the number of bits in the Genmask field (just as it is on a workstation). The kernel checks each entry in the table against the destination IP address of the packet it recieved, and it forwards the packet on the first match it finds. This means that multiple (static) routes to the same destination are not used if you have simple static routing. In the case of a tie - two entries with identical Destination and Genmask - the one with the lower metric value is chosen. Should the metrics be equal, the more recent entry is chosen. The kernel doesn't remember when the entries were made for static routes, but it knows that when someone enters a route equivalent to an existing route, the intention is most likely to use the new route. This is convenient if you need to temporarily route around a particular gateway or have some other testing in mind. You can enter the temporary route, and it will be used. When you delete it, the previous route is used.

Unroutable Packets

Each of the other routers must also have routing table entries for the network(s) and host(s) it is expected to forward. If they don't, then they will either use their defualt route, or, if no default route exists, they will reply with an ICMP: host unreachable message. The pathological case is when the route points back to the sending router, which forms a loop. (Router_A sends to router_B, which sends to router_A, and so on...). Fortunately, IP packets all contain a TTL (Time To Live) field which is decremented every time the packet is forwarded. Eventually (actually, very quickly), the packet will be discarded. Nonetheless, such misconfigurations mean that the packet will not find its destination, which results in performance degradation for correctly routed packets on the network.

Misconfigred Routes - ICMP Redirects

Another situation arises when router_A forwards a packet to router_B when it could (and should) have forwarded it directly to router_C. That is, all three routers are on the same subnet, but router_A is ignorant of (one or more of) router_C's routes. When router_A forwards a packet to router_B, and router_B notices that the packet should have been sent directly to router_C, it forwards the packet, but alerts router_A to the fact with an ICMP: redirect message telling router_A how to forward packets of that type in the future. Router_A notes this by adding a new (host route) entry in its routing table. You can quickly spot these entries because they have the UDGH flags all set. Of note is the D, which indicates that the route was added either dynamically or due to a redirect.

Static vs. Dynamic Routing

There are two methods of configuring a routing table. If the table is populated by you (or by a script on your behalf) using the route command, then it is known as static routing. If it is populated automatically by a daemon such as routed, you are using dynamic routing.

Static routing is great because the reassurance of knowing exactly what the router will do with a packet at all times is worth the extra effort. However, static routing cannot be used in every situation, and is by no means the only way to do things with routers.