What is happening at each row of this netstat-nr command?

Question

I have a problem that I do not understand. How do I evaluate what is happening in each row and which row matches a destination address of 183.77.42.58 and why?

What is happening at each row of this netstat-nr command?

Answer 1

This netstat -nr command has produced a fairly standard routing table - so if looking for Google help, just look at how to interpret a routing table, but to answer your question -

When a packet comes in, it will match the most specific row, and then be directed out the interface. The combination of Network Destination and Netmask allow the system to calculate the range of IP's. In this case, its fairly simple because a netmask of 255.255.255.255 means 1 IP address, and a netmask of 255.255.255.0 means everything matched by the first 3 digits of the IP address (effectively X.X.X.*)

A network with 0.0.0.0 and netmask of 0.0.0.0 means default gateway = all traffic not matched by a more specific route.

(Metrics determine where to send a packet where there are 2 rows with the same IP range and netmask - we can ignore this here)

The IP address 183.77.48.58 is matched by row 2 and sent out 183.77.42.13, because It does not match row 3, but is in the range 183.77.42.0 - 183.77.42.254.

Answer 2

note- I prefer davidgo's answer to mine. And I don't disagree with him. So please accept his over mine.

I have a problem that I do not understand. How do I evaluate what is happening in each row and which row matches a destination address of 183.77.42.58 and why?

row 2 will match. As it's on the same network. It matches anything that starts 183.77.42

A packet comes in or is generated locally.

This isn't the full formula, but it's sufficient to answer the main thing in your question. The formula that routing will use is to look at the destination IP of that packet. AND it with the netmask, send it out the specified Interface, addressed to the Gateway(router) specified.

Absolutely any packet will match the first row. So there might be something that causes that row to be tested last e.g. I think it's that it has the most 1s in the netmask. If those are the same then Metric is a thing that affects which row is looked at first. So in this case metric isn't relevant.

The last row listed (dest 255.255.255.255) is I the one tested first as it has the most 1s in the netmask.. It tests to see if the IP is destined to a broadcast address. i.e. it tests to see if the destination IP = 255.255.255.255 It does that by ANDing the address with 255.255.255.255 which is all 1s, and maintains the IP as is, then it tests to see if it matches 255.255.255.255.

The row 3, is testing for a destination of an IP which is clearly a gateway itself. The mask is 255.255.255.255 so the IP comes in, it is maintained as is and see if it equals that .18 address. If it does then, for whatever reason, it doesn't get sent out, it just gets sent to what's called the loopback interface, which is 127/8 e.g. 127.0.0.1 which is essentially an internal virtual interface, within the machine itself.

Row 2 is very important, it means if the destination IP is on the same network then send it out.

And Row 1 is very important, it would probably run last.. it matches absolutely anything. And sends it out. So if something matched before it then that row won't apply to it.