routes

Overview

Once a Linux host has interfaces and addresses, its routing table decides where to send each packet. Viewing and understanding routes on Linux is essential for diagnosing connectivity. This lesson covers routes from the Linux command line.

Learning objectives

• View the Linux routing table.
• Identify the default route (gateway).
• Interpret how a destination is matched to a route.

Core concept

The routing table tells the kernel where to send packets for each destination network. On Linux you view it with ip route (or ip r). Key entries:

• The default route (default via <gateway>) — where to send anything not matching a more specific route; this is the host's default gateway.
• Directly connected networks — reachable without a gateway (via a local interface).
• More specific routes take precedence (longest-prefix match, as in the networking path).

How it works

For each outbound packet, the kernel looks up the destination in the routing table and picks the most specific matching route, forwarding via that route's gateway or interface. If the destination is on a directly connected network, it goes out that interface directly; otherwise it goes to the default gateway. A missing or wrong default route is a classic reason a host can reach the local network but not the internet — exactly the "gateway" concept from the networking path, seen here in Linux tooling.

Practical example

$ ip route
default via 192.168.1.1 dev enp3s0
192.168.1.0/24 dev enp3s0 proto kernel scope link src 192.168.1.50

The first line is the default route — anything not local goes to gateway 192.168.1.1. The second says 192.168.1.0/24 is directly connected via enp3s0, so local traffic needs no gateway. A packet to 8.8.8.8 matches only the default route → sent to 192.168.1.1.

Cybersecurity relevance

Reading routes is core to network diagnostics and to understanding a host's reachability. During investigation, unexpected routes can indicate misconfiguration or tampering (e.g. traffic being steered through an unexpected gateway, a possible man-in-the-middle setup). Confirming the default gateway and connected networks helps determine what a compromised host can reach — relevant to assessing lateral movement and to troubleshooting why connectivity fails. Route inspection complements interface inspection in mapping a host's network position.

Common mistakes

• Confusing directly connected routes with the default route — local networks need no gateway; everything else uses the default.
• Overlooking a missing/incorrect default route, the common cause of "local works, internet doesn't."
• Ignoring unexpected routes, which can signal misconfiguration or traffic redirection.

Key takeaways

• ip route/ip r shows the Linux routing table; the default via <gateway> entry is the host's default gateway.
• The kernel matches each packet to the most specific route (directly connected networks need no gateway; everything else uses the default).
• Route inspection reveals reachability and can expose misconfiguration or malicious traffic redirection — key for diagnostics and investigation.

Check your understanding

• In ip route output, how do you identify the default gateway?
• Why can a host with a correct IP but a missing default route reach local machines but not the internet?