How do I read/interpret a (netstat) routing table ?

[Thommy Kanther]

After entering a command

netstat -rn

on my computer I am getting the following information (see bottom).

Ok, I know this routing table is used to direct TCP/IP packets to their destination.

But how do I interpret this table ?

For example has a routing command line higher priority the lower it is listed in
the table ?

Assume on local computer 192.168.0.14 a TCP-IP packet is arriving with the destination
192.168.0.32

Starting with the last entry line and going higher step by step the first line which
matches
the destination mask of the two first columns is

192.168.0.0 255.255.255.0 192.168.0.14 192.168.0.14 30

Hmm, from my point of view the routing table says the following: Forward the
packet to computer 192.168.0.14 over interface 192.168.0.14. But what makes this for
a sense? This is the local computer. Why should the packet be forward to itself ?

Shouldn't be a the entry line as follows:

192.168.0.0 255.255.255.0 192.168.0.31 192.168.0.1 30

I am a bit confused.

Could someone give me a good explanation or direct my to a web pages with
good sample evaluations ?

Thank ypu
Thomas


Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.14 30
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.0.0 255.255.255.0 192.168.0.14 192.168.0.14 30
192.168.0.14 255.255.255.255 127.0.0.1 127.0.0.1 30
192.168.0.255 255.255.255.255 192.168.0.10 192.168.0.14 30
224.0.0.0 240.0.0.0 192.168.0.10 192.168.0.14 30
255.255.255.255 255.255.255.255 192.168.0.10 192.168.0.14 1
Default Gateway: 192.168.0.1
===========================================================================
Persistent Routes:
None

 

[Og]

This article describes TCP connection states and how to read Netstat
(NETSTAT.EXE) output.
http://support.microsoft.com/kb/137984

Steve

 

[Steve Winograd [MVP]]

I've answered your questions in-line.

After entering a command

netstat -rn

on my computer I am getting the following information (see bottom).

Ok, I know this routing table is used to direct TCP/IP packets to their destination.

But how do I interpret this table ?

For example has a routing command line higher priority the lower it is listed in
the table ?

Position in the table has no significance. When more than one route
matches a destination address, the route with the longest subnet mask
(most consecutive 1-bits) is used. When multiple routes match the
destination and have subnet masks of the same length, the route with
the lowest metric is used.

Assume on local computer 192.168.0.14 a TCP-IP packet is arriving with the destination
192.168.0.32

Starting with the last entry line and going higher step by step the first line which
matches
the destination mask of the two first columns is

192.168.0.0 255.255.255.0 192.168.0.14 192.168.0.14 30

Hmm, from my point of view the routing table says the following: Forward the
packet to computer 192.168.0.14 over interface 192.168.0.14. But what makes this for
a sense? This is the local computer. Why should the packet be forward to itself ?

That's a subnet route (mask 255.255.255.0). It says to send packets
for IP addresses 192.168.0.x via this computer's LAN connection. For
example, it's used to send packets to 192.168.0.32.

But it isn't used to send packets to 192.168.0.14. There's a host
route (mask 255.255.255.255) that matches 192.168.0.14, and it has a
longer subnet mask than the subnet route:

192.168.0.14 255.255.255.255 127.0.0.1 127.0.0.1 30

The gateway address of the host route is 127.0.0.1, the "loopback"
address, indicating that the 192.168.0.14 address is local to this
computer.

Shouldn't be a the entry line as follows:

192.168.0.0 255.255.255.0 192.168.0.31 192.168.0.1 30

There's no need for such a line. The subnet route matches all
addresses that start with 192.168.0.

I am a bit confused.

Route tables are confusing for everyone at first.

Could someone give me a good explanation or direct my to a web pages with
good sample evaluations ?

The Cable Guy - December 2001
Understanding the IP Routing Table
http://www.microsoft.com/technet/community/columns/cableguy/cg1201.mspx

Thank ypu
Thomas

You're welcome.

Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.14 30
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.0.0 255.255.255.0 192.168.0.14 192.168.0.14 30
192.168.0.14 255.255.255.255 127.0.0.1 127.0.0.1 30
192.168.0.255 255.255.255.255 192.168.0.10 192.168.0.14 30
224.0.0.0 240.0.0.0 192.168.0.10 192.168.0.14 30
255.255.255.255 255.255.255.255 192.168.0.10 192.168.0.14 1
Default Gateway: 192.168.0.1
===========================================================================
Persistent Routes:
None

--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com

 

[Anand]

After entering a command

netstat -rn

on my computer I am getting the following information (see bottom).

Ok, I know this routing table is used to direct TCP/IP packets to their destination.

But how do I interpret this table ?

For example has a routing command line higher priority the lower it is listed in
the table ?

Assume on local computer 192.168.0.14 a TCP-IP packet is arriving with the destination
192.168.0.32

Starting with the last entry line and going higher step by step the first line which
matches
the destination mask of the two first columns is

192.168.0.0 255.255.255.0 192.168.0.14 192.168.0.14 30

Hmm, from my point of view the routing table says the following: Forward the
packet to computer 192.168.0.14 over interface 192.168.0.14. But what makes this for
a sense? This is the local computer. Why should the packet be forward to itself ?

Shouldn't be a the entry line as follows:

192.168.0.0 255.255.255.0 192.168.0.31 192.168.0.1 30

I am a bit confused.

Could someone give me a good explanation or direct my to a web pages with
good sample evaluations ?

Thank ypu
Thomas

Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.14 30
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.0.0 255.255.255.0 192.168.0.14 192.168.0.14 30
192.168.0.14 255.255.255.255 127.0.0.1 127.0.0.1 30
192.168.0.255 255.255.255.255 192.168.0.10 192.168.0.14 30
224.0.0.0 240.0.0.0 192.168.0.10 192.168.0.14 30
255.255.255.255 255.255.255.255 192.168.0.10 192.168.0.14 1
Default Gateway: 192.168.0.1
===========================================================================
Persistent Routes:
None

Probably, the routing table what ever you see, I think is not
configured properly.
I would like to explain the fields first,
Network Destination --> The one which is outside your subnet,
basically it has different subnet mask compared to local.
NetMask --> Makes it easier for the Router (layer 3 device, which
isolates 2 subnets). This is used to identify which subnet the packet
must go to.
Gateway --> There could be more than one gateway within a network, so
to reach the destination we configure which could be the best possible
gateway
Interface --> Assuming that we could have more number of interfaces
(ethernet interfaces, eth0, eth1, eth2...) and each interface would be
assigned an IPAddress,
so this information is required, on how to reach
the gateway and through which interface it needs to push the packet.
Metric --> Provides the path cost, basically for static routing the
value would be 1 (default, but we can change it) and for dynamic
routing (RIP, IGRP, OSPF) it varies.


Assume that we have a packet with destination IP address as w.x.y.z
arrives to Router, so now the router checks the Routing table and if
it identifies that w.x.y.0/24 is present in the table then it will try
to reach the concerned gateway by pushing through the respective
interface. Assume that there were two entries of the same with metrics
different, then the router has to choose the one which has a lower
value. Assume the router did not find any entries in the routing table
then it would go to default gateway.
Now assume the other scenario, a packet with the destination IP
address k.l.m.n arrives to router, and k.l.m.0/24 is default mask of
the router, then it implies that the packet is destined to same
network and it does not push to outside subnet.

if for further queries search "routing algorithm" in google. you could
find many doc's.