Understanding Linux IP Routing Tables: Decoding “ip route” Output and Network Path Selection


6 views 
10.1.40.0/24 via 10.255.115.1 dev eth1
10.255.114.0/23 dev eth1  proto kernel  scope link  src 10.255.115.18
default via 10.1.1.1 dev eth0  metric 100

Let me explain each line with technical precision:

1. 10.1.40.0/24 via 10.255.115.1 dev eth1
   - Destination: 10.1.40.0/24 network
   - Next hop: 10.255.115.1 (gateway/router)
   - Interface: eth1

This means any traffic destined for the 10.1.40.0/24 network will be:

  1. Sent through interface eth1
  2. Forwarded to the gateway at 10.255.115.1
  3. The gateway will then handle routing to the final destination
2. 10.255.114.0/23 dev eth1 proto kernel scope link src 10.255.115.18
   - Network: 10.255.114.0/23 (local subnet)
   - Interface: eth1
   - Protocol: kernel (automatically added)
   - Scope: link (local network segment)
   - Source IP: 10.255.115.18

Key points about this entry:

  • This is a directly connected network - no gateway/router needed
  • The proto kernel indicates this route was added by the kernel
  • scope link means the route is valid only for this local network
  • src specifies the source IP to use when sending to this network
3. default via 10.1.1.1 dev eth0 metric 100
   - Default route (0.0.0.0/0)
   - Gateway: 10.1.1.1
   - Interface: eth0
   - Priority: metric 100

This is the catch-all route for traffic that doesn't match any other routes. The metric 100 indicates the priority of this route when multiple default routes exist.

To verify the routing decision for a specific IP:

ip route get 10.1.40.5
ip route get 10.255.114.20
ip route get 8.8.8.8

Example output for the first command:

10.1.40.5 via 10.255.115.1 dev eth1 src 10.255.115.18 
    cache

The complete syntax for route attributes includes:

proto RTPROTO - routing protocol identifier
    (kernel, boot, static, dhcp, etc.)
scope SCOPE_VAL - scope of the route
    (global, link, host, etc.)
src ADDRESS - preferred source address

Common protocol values:

  • kernel: automatically added by kernel for local addresses
  • static: manually configured static route
  • dhcp: route added by DHCP client

To add a static route (for comparison):

ip route add 192.168.1.0/24 via 10.0.0.1 dev eth0 proto static

To see all routes including cached entries:

ip route show table all

To display route cache (kernel 4.x and earlier):

ip route show cache

The Linux ip route command displays the kernel's IP routing table, which determines how network packets are forwarded. Let's break down your specific output:

10.1.40.0/24 via 10.255.115.1 dev eth1
10.255.114.0/23 dev eth1  proto kernel  scope link  src 10.255.115.18
default via 10.1.1.1 dev eth0  metric 100

Let's examine each route entry and what it means for network traffic:

1. Specific Network Route

10.1.40.0/24 via 10.255.115.1 dev eth1

This means:

  • Any traffic destined for the 10.1.40.0/24 network
  • Will be forwarded to the gateway/router at 10.255.115.1
  • Using the eth1 network interface

2. Directly Connected Network

10.255.114.0/23 dev eth1  proto kernel  scope link  src 10.255.115.18

This indicates:

  • The 10.255.114.0/23 network is directly connected to eth1
  • No gateway is needed as the destination is on the same layer 2 segment
  • The source IP for outgoing packets will be 10.255.115.18

3. Default Route

default via 10.1.1.1 dev eth0  metric 100

This defines:

  • All traffic not matching more specific routes
  • Will be sent to the default gateway 10.1.1.1
  • Using the eth0 interface
  • With a route priority metric of 100 (used when multiple routes exist)

The proto kernel scope link src components have specific meanings:

proto kernel - Route was automatically created by the kernel
scope link - Route is valid only within this network segment
src 10.255.115.18 - Preferred source IP address for outgoing packets

To verify your routing configuration, you can use several commands:

# Show complete routing table
ip route show

# Test connectivity to a specific route
ping -I eth1 10.255.114.1

# Trace the route path
traceroute 10.1.40.5

Here's an example of how to add and delete routes programmatically:

# Add a new route
ip route add 192.168.1.0/24 via 10.1.1.100 dev eth0

# Delete a route
ip route del 10.1.40.0/24

# Change the default gateway
ip route change default via 10.1.1.2 dev eth0

For more complex scenarios, you might need:

# Policy-based routing
ip rule add from 10.255.115.18 lookup 100
ip route add default via 10.1.1.3 table 100

# Multipath routing
ip route add default scope global nexthop via 10.1.1.1 dev eth0 weight 1 \
nexthop via 10.1.1.2 dev eth0 weight 2