What the table contains
Each entry holds:
- destination - the target subnet (
10.0.0.0/24, or0.0.0.0/0for the default route) - next hop - the IP of the next router (
via X.X.X.X), or-when the subnet is directly connected - dev - the interface to send the packet out of
- metric - priority (lower is better) when multiple entries match
- scope -
link(same subnet) orglobal - proto - who installed the route:
kernel,static,boot,ra(router advertisement),bgp,ospf,dhcp
Longest prefix match
When a packet is destined for 1.2.3.4, the kernel finds the longest
matching subnet in the table. For example:
default via 192.168.1.1 dev eth0
10.0.0.0/8 via 192.168.1.254 dev eth0
10.42.0.0/16 via 10.42.0.1 dev wg0
8.8.8.8- does not match10.x.x.x, falls through to default, exits via 192.168.1.110.99.5.5- matches/8but not/16, exits via 192.168.1.25410.42.7.7- matches both/8and/16, but/16is longer, so it exits via wg0
This rule is universal. BGP and OSPF do not change it: they only INSERT entries into the table. The selection itself is done by the kernel FIB.
Default route
0.0.0.0/0 covers everything not matched by a more specific entry. On
a regular host this entry is required for internet access.
Without a default route:
$ ping 8.8.8.8
ping: connect: Network is unreachable
How to inspect the table
bash
ip route # full main table
ip -4 route show # IPv4 only
ip route get 1.2.3.4 # which route the kernel would pick for 1.2.3.4 right now
Besides main, there are also the local table (addresses of the machine itself) and the
default table (separate tables selected via ip rule for policy routing).
Where the kernel stores this
- RIB (Routing Information Base) - what routing protocols and the admin write in
- FIB (Forwarding Information Base) - a lookup-optimized structure (trie) that the kernel actually uses to forward each packet
For most tasks the difference does not matter.