Understanding the ‘src’ Field in Linux IP Route Command: Practical Usage and Examples


2 views

The src field in ip route show output specifies the preferred source IP address that will be used when sending packets via this particular route. This becomes particularly important in systems with multiple IP addresses assigned to interfaces.

# Example output showing src field
$ ip route show
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100 
default via 192.168.1.1 dev eth0 src 192.168.1.100

The source IP selection becomes critical in these scenarios:

  • Multi-homed systems with multiple network interfaces
  • Servers with multiple IPs on a single interface (IP aliasing)
  • Routing between different network namespaces
  • VPN configurations with overlapping address spaces

Let's look at some common use cases with code examples:

# Adding a route with specific source IP
ip route add 10.0.0.0/24 via 192.168.1.1 dev eth0 src 192.168.1.100

# Viewing routes with source IP information
ip -br route show | grep -E '^default|^192.168.1.0/24'

# Modifying an existing route's source IP
ip route change default via 192.168.1.1 dev eth0 src 192.168.1.200

When debugging routing issues related to source IP selection:

# Check which source IP would be used for a specific destination
ip route get 8.8.8.8

# Output example:
# 8.8.8.8 via 192.168.1.1 dev eth0 src 192.168.1.100 uid 1000

The Linux kernel follows this priority when selecting source addresses:

  1. Explicitly specified source address (via src in route)
  2. Primary address of the outgoing interface
  3. Any other address on the outgoing interface

You can verify this behavior with:

# List all IP addresses assigned to interfaces
ip -br addr show

# Check the primary address (shown first for each interface)
ip -br addr show | awk '{print $1,$3}'

For a server with multiple IPs handling different services:

# Assign IPs to interface
ip addr add 192.168.1.100/24 dev eth0
ip addr add 192.168.1.101/24 dev eth0

# Set up routes with different source IPs
ip route add 10.0.1.0/24 via 192.168.1.1 dev eth0 src 192.168.1.100
ip route add 10.0.2.0/24 via 192.168.1.1 dev eth0 src 192.168.1.101

# Verify the configuration
ip route show table all | grep -E '10.0.[12]'

Watch out for these issues when working with source IP routing:

  • Firewall rules blocking unexpected source IPs
  • Applications binding to specific IP addresses
  • RPF (Reverse Path Filtering) causing packet drops
  • DNS resolution behaving differently based on source IP

To check RPF status:

sysctl -a | grep \\.rp_filter

Understanding the src field in IP routing is essential for proper network configuration, especially in complex environments. The examples provided should give you practical knowledge to implement and troubleshoot source-based routing in your systems.

When working with network routing in Linux, the ip route show command is essential for inspecting routing tables. However, the src field in its output often causes confusion even among experienced sysadmins.

The src field specifies the preferred source IP address that the kernel will use when sending packets through this route. This becomes particularly important in systems with multiple network interfaces or IP addresses.

Consider this example output:

default via 192.168.1.1 dev eth0 src 192.168.1.100 
10.0.0.0/24 dev eth1 src 10.0.0.15

The src value is used in these key scenarios:

  • When the application doesn't explicitly bind to a specific address
  • For outgoing connections where source IP selection is required
  • When responding to incoming packets on multi-homed systems

To see how this works in practice, let's examine a multi-homed server:

# ip address show
1: lo:  ...
2: eth0:  ... inet 192.168.1.100/24
3: eth1:  ... inet 10.0.0.15/24

# ip route show
default via 192.168.1.1 dev eth0 src 192.168.1.100
10.0.0.0/24 dev eth1 src 10.0.0.15

You can explicitly set the preferred source address when adding routes:

# ip route add default via 192.168.1.1 dev eth0 src 192.168.1.200
# ip route change default via 192.168.1.1 dev eth0 src 192.168.1.200

If you're seeing unexpected source addresses in your traffic:

  1. Verify your routing table with ip route show
  2. Check if applications are binding to specific interfaces
  3. Test connectivity while monitoring with tcpdump

Remember that the src field is just one factor in Linux's complex source address selection algorithm, which also considers:

  • Weak host model behavior
  • RPF (Reverse Path Filtering) settings
  • Application-specific bindings