Routing

Reading a routing table

A router picks the route with the longest matching prefix, then the lowest administrative distance, then the lowest metric. 0.0.0.0/0 is the default route, the shortest possible match, so it only wins when nothing else does.

ip route                           # main table
ip route show table all
ip -6 route
ip route get 8.8.8.8               # which route WOULD be used, and via what
ip route get 10.0.5.9 from 10.0.1.4

$ ip route
default via 192.168.1.1 dev eth0 proto dhcp metric 100
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.2
169.254.0.0/16 dev eth0 scope link metric 1000
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.37 metric 100

Longest prefix match, worked

Destination 10.1.2.55 against this table:

10.1.2.0/24 wins. A /32 host route beats everything, which is how VPN clients and load balancers pin single destinations.

Static routes

ip route add 10.50.0.0/16 via 192.168.1.254 dev eth0
ip route add default via 192.168.1.1
ip route add 10.9.9.9/32 dev tun0            # host route, no gateway
ip route replace default via 192.168.1.2
ip route del 10.50.0.0/16
sysctl -w net.ipv4.ip_forward=1              # make the box a router

Persist them per distro (netplan routes:, or nmcli con mod <con> +ipv4.routes "..."), because ip route changes are runtime only and vanish on reboot.

Administrative distance and metrics

When two sources offer the same prefix, administrative distance decides which one is installed. Lower is more trusted. These are the Cisco defaults everyone quotes.

Within one protocol the metric breaks the tie: RIP counts hops, OSPF sums interface costs (10⁸ ÷ bandwidth in bps), and BGP runs a long attribute list starting with weight, local preference, and AS path length.

Static vs dynamic routing

RIP, OSPF, and BGP at a glance

- RIP advertises its whole table every 30 s and suffers count-to-infinity, patched with split horizon and route poisoning. Treat it as history. - OSPF floods link-state advertisements, every router builds the same topology graph, then runs Dijkstra locally. Areas limit flooding, and every area must attach to area 0. - BGP exchanges reachability with AS-path loop prevention. It carries the full internet table (well over 900,000 IPv4 prefixes) and chooses on policy, not distance. Route leaks and hijacks are BGP failures, which RPKI origin validation is meant to reduce.

ECMP, policy routing, and asymmetry

ECMP installs several equal-cost next hops and hashes flows across them, so a flow stays on one path (which TCP needs) while the aggregate spreads.

ip route add default \
  nexthop via 192.168.1.1 weight 1 \
  nexthop via 192.168.1.2 weight 1
ip rule add from 10.8.0.0/24 table 100      # policy routing by source
ip route add default via 10.8.0.1 table 100
ip rule show

Two failure modes worth knowing. Asymmetric routing (out one path, back another) is fine for stateless routers and fatal for stateful firewalls, which drop the reply as unsolicited. A routing loop shows up as TTL exhaustion, and traceroute prints the same two hops alternating forever.