Understand-IP-Route-Table
All computers running any version of Windows and the supplied TCP/IP protocol use an IP routing table. The IP routing table stores information about destinations and how they can be reached. There are a series of default entries based on the configuration of the node. You can add entries with TCP/IP utilities or entries can be added dynamically through interaction with routers.
When an IP packet is forwarded, the IP routing table is used to determine:
1.
2.
The next-hop IP address
For a direct delivery (the destination is a neighboring node), the next-hop IP address is the destination address in the packet. For an indirect delivery (the destination is not a neighboring node), the next-hop address is the address of a router.
The next-hop interface
The next-hop interface identifies either a physical interface (for example, a network adapter) or a logical interface (for example, a tunneling interface) that is used to forward the packet.
After the next-hop address and interface are determined, the packet is passed to the Address Resolution Protocol (ARP). For LAN technologies such as Ethernet and Token Ring, ARP attempts to resolve the link-layer address (also known as the media access control [MAC] address) for the next-hop address, and forward the packet by using the next-hop interface.
The following are the fields of a typical IP routing table entry:
Routing table entries can be used to store the following types of routes:
To determine which routing table entry is used for forwarding, IP uses the following process:
•
•
For each entry in the routing table, a bit-wise logical AND operation is performed between the destination IP address and the Network Mask field. The result is compared with the Destination field of the entry for a match.
To perform a bit-wise logical AND between the destination IP address and the network mask of the route, IP compares each bit in the destination IP address to the corresponding bit in the subnet mask. If both bits are 1's, the resulting bit is 1; otherwise, the result is 0. Because of the way in which the subnet mask is defined, the result of the bit-wise logical AND operation is:
•
•
For each bit in the subnet mask that is set to 1, the corresponding bit in the result is copied from the destination IP address.
For each bit in the subnet mask that is set to 0, the corresponding bit in the result is set to 0.
A good example of performing a bit-wise logical AND is in determining the IP address prefix for an IP address configuration. To determine the IP address prefix, a bit-wise logical AND of the assigned IP address with its subnet mask is performed. The result is the IP address prefix.
For example, for the IP address 192.168.98.112 with the subnet mask 255.255.255.0, the result of the bit-wise logical AND is:
•
•
For the first 24 bits, which correspond to the "255.255.255" portion of the subnet mask, the corresponding bit from the destination IP address is copied, resulting in 192.168.98 for the first three octets.
For the last 8 bits, which correspond to the "0" portion of the subnet mask, the corresponding bit is set to 0, resulting in 0 for the last octet.
Therefore, 192.168.98.112 AND 255.255.255.0 is 192.168.98.0.
The list of matching routes is compiled. The route that has the longest match (that is, the route with the highest number of bits set to 1 in the subnet mask) is selected. The longest matching route is the most specific route to the destination IP address. If there are multiple longest match routes (for example, multiple routes to the same address prefix), the router uses the lowest metric to select the best route. If there are multiple longest matching routes with the lowest metric, the node randomly selects which routing table entry to use.
The result of the route determination process is the selection of a single route in the routing table. If this process fails to select a route, IP indicates a routing error. For a sending host, an IP routing error is indicated internally to an upper layer protocol, such as TCP or UDP. For a router, an ICMP Destination Unreachable-Host Unreachable message is sent to the sending host and the packet is discarded.
After determining the single route in the routing table with which to forward the packet, the next-hop address and interface are determined by the following process:
•
•
If the address in the Next-Hop field is either blank or is an address that is assigned to an interface on the forwarding node:
The next-hop address is set to the destination IP address of the IP packet.
The next-hop interface is set to the interface that is specified in the Interface field.
If the address in the Next-Hop field is not an address that is assigned to an interface on the forwarding node:
The next-hop address is set to the address in the Next-Hop field for the route.
The next-hop interface is set to the interface that is specified in the Interface field.
The following table lists the default routing table for a Windows 2000–based host (that is, not a router). The host has a single network adapter and is configured with the IP address 157.60.136.41, subnet mask 255.255.252.0 (/22), and a default gateway of 157.60.136.1. To view the IP routing table on a computer running Windows 2000, type route print or netstat -r at a command prompt.
========================================================================= == Interface List 0x1 ........................... MS TCP Loopback interface 0x1000003 ...00 b0 d0 e9 41 43 ...... 3Com EtherLink PCI ========================================================================= == ========================================================================= == Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 157.60.136.1 15.60.136.41 1 127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1 157.60.136.0 255.255.252.0 157.60.136.41 157.60.136.41 1 157.60.136.41 255.255.255.255 127.0.0.1 127.0.0.1 1 157.60.255.255 255.255.255.255 157.60.136.41 157.60.136.41 1 224.0.0.0 224.0.0.0 157.60.136.41 157.60.136.41 1 255.255.255.255 255.255.255.255 157.60.136.41 157.60.136.41 1 Default Gateway: 157.60.136.1 ========================================================================= == Persistent Routes: None
Note that two interfaces are listed. One interface corresponds to an installed network adapter (3Com EtherLink PCI) and the other is an internal loopback interface (MS TCP Loopback Interface).
The Windows 2000 IP routing table uses an IP address to identify an interface in the Interface field for the route. Therefore, the following process determines the next-hop address and interface:
•
•
If the address in the Gateway field is an address that is assigned to an interface on the forwarding node:
The next-hop address is set to the destination IP address of the IP packet.
The next-hop interface is set to the interface to which the address in the Interface field is assigned.
If the address in the Gateway field is not an address that is assigned to an interface on the forwarding node:
The next-hop address is set to the address in the Gateway field.
The next-hop interface is set to the interface to which the address in the Interface field is assigned.
This Windows 2000 IP routing table contains the following entries:
The following are examples of how this routing table is used to determine the next-hop IP address and interface for several different destinations:
For more information about IP routing in Windows 2000, consult the following resources:
For any questions or feedback regarding the content of this column, please write to Microsoft TechNet.
For a list and additional information on all The Cable Guy columns, click here.