[Network] Routing Table

The Cable Guy - December 2001

Understanding the IP Routing Table

Updated: May 9, 2007

 

By The Cable Guy

Communication problems on TCP/IP networks are sometimes caused by missing or incorrect routes in the Internet Protocol (IP) routing tables of hosts and routers. This article describes the contents of IP routing tables on Windows XP or Windows Server 2003-based hosts and the process that the TCP/IP component uses to determine which route to use to send or forward a packet.

Note  This article is written for IT professionals who already understand TCP/IP and IP addressing. For more information, see TCP/IP Fundamentals for Microsoft Windows, Chapter 3 – IP Addressing.

On This Page

	Introduction
	Contents of an IP Routing Table
	Route Determination Process
	Next-Hop Address and Interface Determination Process
	For More Information

Introduction

IP routing is the process of forwarding a packet based on the destination IP address. Routing occurs at a sending TCP/IP host and at an IP router. In each case, the IP layer at the sending host or router must decide where to forward the packet. To make these decisions, the IP layer consults a routing table stored in memory.

All computers running any version of Windows and the supplied TCP/IP protocol use an IP routing table. The IP routing table stores information about destinations and how they can be reached. There are a series of default entries based on the configuration of the node. You can add entries with TCP/IP utilities or entries can be added dynamically through interaction with routers.

When an IP packet is forwarded, the IP routing table is used to determine:

1.	The next-hop IP address For a direct delivery (the destination is a neighboring node), the next-hop IP address is the destination address in the packet. For an indirect delivery (the destination is not a neighboring node), the next-hop address is the address of a router.
2.	The next-hop interface The next-hop interface identifies either a physical interface (for example, a network adapter) or a logical interface (for example, a tunneling interface) that is used to forward the packet.

After the next-hop address and interface are determined, the packet is passed to the Address Resolution Protocol (ARP). For LAN technologies such as Ethernet and Token Ring, ARP attempts to resolve the link-layer address (also known as the media access control [MAC] address) for the next-hop address, and forward the packet by using the next-hop interface.

Top of page

Contents of an IP Routing Table

The following are the fields of a typical IP routing table entry:

•	Destination The destination can be either an IP address or a class-based, subnetted, or supernetted address prefix. In the Windows XP or Windows Server 2003 IP routing table, this column is named Network Destination.
•	Network Mask The bit mask that is used to match a destination IP address to the value in the Destination field. In the Windows XP or Windows Server 2003 IP routing table, this column is named Netmask.
•	Next-Hop The IP address to which the packet is forwarded. In the Windows XP or Windows Server 2003 IP routing table, this column is named Gateway.
•	Interface The network interface that is used to forward the IP packet.
•	Metric A number used to indicate the cost of the route so that the best route, among potentially multiple routes to the same destination, can be selected. A common use of the metric is to indicate the number of hops (the number of links or routers to cross) en route to the destination.

Routing table entries can be used to store the following types of routes:

•	Directly-attached network routes Routes for subnets to which the node is directly attached. For directly-attached network routes, the Next-Hop field can either be blank or contain the IP address of the interface on that subnet.
•	Remote network routes Routes for subnets that are available across routers and are not directly attached to the node. For remote network routes, the Next-Hop field is the IP address of a local router.
•	Host routes A route to a specific IP address. Host routes allow routing to occur on a per-IP address basis. For host routes, the destination is a specific IP address and the network mask is 255.255.255.255.
•	Default route The default route is used when a more specific network or host route is not found. The default route destination is 0.0.0.0 with the network mask of 0.0.0.0. The next-hop address of the default route is typically the default gateway of the node.

Top of page

Route Determination Process

To determine which routing table entry is used for forwarding, IP uses the following process:

1.

For each entry in the routing table, perform a bit-wise logical AND operation between the destination IP address and the Network Mask field and compare the result with the Destination field of the entry for a match. To perform a bit-wise logical AND between the destination IP address and the network mask of the route, IP compares each bit in the destination IP address to the corresponding bit in the subnet mask. If both bits are 1's, the resulting bit is 1; otherwise, the result is 0. Because of the way in which the subnet mask is defined, the result of the bit-wise logical AND operation is: • For each bit in the subnet mask that is set to 1, the corresponding bit in the result is copied from the destination IP address. • For each bit in the subnet mask that is set to 0, the corresponding bit in the result is set to 0. A good example of performing a bit-wise logical AND is in determining the IP address prefix for an IP address configuration. To determine the IP address prefix, a bit-wise logical AND of the assigned IP address with its subnet mask is performed. The result is the IP address prefix. For example, for the IP address 192.168.98.112 with the subnet mask 255.255.255.0, the result of the bit-wise logical AND is: • For the first 24 bits, which correspond to the "255.255.255" portion of the subnet mask, the corresponding bit from the destination IP address is copied, resulting in 192.168.98 for the first three octets. • For the last 8 bits, which correspond to the "0" portion of the subnet mask, the corresponding bit is set to 0, resulting in 0 for the last octet. Therefore, 192.168.98.112 AND 255.255.255.0 is 192.168.98.0.

2.

Compile the list of matching routes and select the route that has the longest match (that is, the route with the highest number of bits set to 1 in the subnet mask). The longest matching route is the most specific route to the destination IP address. If there are multiple longest match routes (for example, multiple routes to the same address prefix), the router uses the lowest metric to select the best route. If there are multiple longest matching routes with the lowest metric, the node can choose which routing table entry to use.

The result of the route determination process is the selection of a single route in the routing table. If this process fails to select a route, IP indicates a routing error. For a sending host, an IP routing error is indicated internally to an upper layer protocol, such as TCP or UDP. For a router, an ICMP Destination Unreachable-Host Unreachable message is sent to the sending host and the packet is discarded.

Top of page

Next-Hop Address and Interface Determination Process

After determining the single route in the routing table with which to forward the packet, IP determines the next-hop address and interface from the following:

•	If the address in the Next-Hop field is either blank or is an address that is assigned to an interface on the forwarding node: Set the next-hop address to the destination IP address of the IP packet. Set the next-hop interface to the interface that is specified in the Interface field.
•	If the address in the Next-Hop field is not an address that is assigned to an interface on the forwarding node: Set the next-hop address to the address in the Next-Hop field for the route. Set the next-hop interface to the interface that is specified in the Interface field.

Example IP Routing Table for Windows XP or Windows Server 2003

The following table lists the default routing table for a Windows XP or Windows Server 2003–based host (that is, not a router). The host has a single network adapter and is configured with the IP address 157.60.136.41, subnet mask 255.255.252.0 (/22), and a default gateway of 157.60.136.1. To view the IP routing table on a computer running Windows XP or Windows Server 2003, type route print or netstat -r at a command prompt.

=========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x1000003 ...00 b0 d0 e9 41 43 ...... 3Com EtherLink PCI
=========================================================================
=========================================================================
Active Routes:
 Network Destination      Netmask       Gateway     Interface     Metric    
          0.0.0.0         0.0.0.0  157.60.136.1  15.60.136.41        1       
        127.0.0.0       255.0.0.0     127.0.0.1     127.0.0.1        1
     157.60.136.0   255.255.252.0 157.60.136.41 157.60.136.41        1
    157.60.136.41 255.255.255.255     127.0.0.1     127.0.0.1        1
   157.60.255.255 255.255.255.255 157.60.136.41 157.60.136.41        1
        224.0.0.0       224.0.0.0 157.60.136.41 157.60.136.41        1
  255.255.255.255 255.255.255.255 157.60.136.41 157.60.136.41        1
 Default Gateway: 157.60.136.1
=========================================================================
Persistent Routes:
None

There are two interfaces are listed. One interface corresponds to an installed network adapter (3Com EtherLink PCI) and the other is an internal loopback interface (MS TCP Loopback Interface).

The Windows XP or Windows Server 2003 IP routing table uses an IP address to identify an interface in the Interface field for the route. Therefore, IP in Windows XP and Windows Server 2003 determines the next-hop address and interface from the following:

•	If the address in the Gateway field is an address that is assigned to an interface on the forwarding node: Set the next-hop address to the destination IP address of the IP packet. Set the next-hop interface to the interface to which the address in the Interface field is assigned.
•	If the address in the Gateway field is not an address that is assigned to an interface on the forwarding node: Set the next-hop address to the address in the Gateway field. Set the next-hop interface to the interface to which the address in the Interface field is assigned.

This example Windows XP or Windows Server 2003 IP routing table contains the following entries:

•	The first entry, network destination of 0.0.0.0 and network mask (netmask) of 0.0.0.0 (/0), is the default route. Any destination IP address that is bit-wise logically ANDed with 0.0.0.0, results in 0.0.0.0. Therefore, the default route is a match for any IP address. If the default route is the longest matching route, the next-hop address is 157.60.136.1 and the next-hop interface is the network adapter that is assigned the IP address 157.60.136.41.
•	The second entry, network destination of 127.0.0.0 and netmask of 255.0.0.0 (/8), is the loopback network route. For all packets that are sent to an address of the form 127.x.y.z, the next-hop address is set to the destination address in the packet and the next-hop interface is the interface that is assigned the address 127.0.0.1 (the loopback interface).
•	The third entry, network destination of 157.60.136.0 and netmask of 255.255.252.0 (/22), is a directly-attached network route. If this route is the longest matching route, the next-hop address is set to the destination address in the packet and the next-hop interface is set to the network adapter that is assigned the IP address 157.60.136.41.
•	The fourth entry, network destination of 157.60.136.41 and netmask of 255.255.255.255 (/32), is a host route for the IP address of the host. For all IP packets sent to 157.60.136.41, the next-hop address is set to 157.60.136.41 and the next-hop interface is the loopback interface.
•	The fifth entry, network destination of 157.60.255.255 and netmask of 255.255.255.255 (/32), is a host route that corresponds to the all-subnets directed broadcast address for the class B address prefix 157.60.0.0/16. For all IP packets sent to 157.60.255.255, the next-hop address is set to 157.60.255.255 and the next-hop interface is the network adapter that is assigned the IP address 157.60.136.41.
•	The sixth entry, network destination of 224.0.0.0 and netmask of 224.0.0.0 (/3), is a route for multicast traffic that is sent by this host. For all multicast packets, the next-hop address is set to the destination address in the packet and the next-hop interface is set to the network adapter that is assigned the IP address 157.60.136.41.
•	The seventh entry, network destination of 255.255.255.255 and netmask of 255.255.255.255 (/32), is a host route that corresponds to the limited broadcast address. For all IP packets sent to 255.255.255.255, the next-hop address is set to 255.255.255.255 and the next-hop interface is the network adapter that is assigned the IP address 157.60.136.41.

The following are examples of how this routing table is used to determine the next-hop IP address and interface for several different destinations:

•	Unicast destination 157.60.136.48 The longest matching route is the third entry in the routing table for the directly-attached network (157.60.136.0/22). The next-hop IP address is set to the destination IP address (157.60.136.48) and the next-hop interface is set to the network adapter that is assigned the IP address 157.60.136.41.
•	Unicast destination 192.168.0.79 The longest matching route is the first entry in the routing table for the default route (0.0.0.0/0). The next-hop IP address is set to the default gateway address (157.60.136.1) and the next-hop interface is the network adapter that is assigned the IP address 157.60.136.41.
•	Multicast destination 224.0.0.1 The longest matching route is the sixth entry in the routing table for the 224.0.0.0/3 route. The next-hop IP address is set to the destination IP address (224.0.0.1) and the next-hop interface is the network adapter that is assigned the IP address 157.60.136.41.
•	Subnet broadcast destination 157.60.139.255 The longest matching route is the third entry in the routing table for the directly-attached network (157.60.136.0/22). The next-hop IP address is set to the destination IP address (157.60.139.255) and the next-hop interface is set to the network adapter that is assigned the IP address 157.60.136.41.
•	Unicast destination 157.60.136.41 The longest matching route is the fourth entry in the routing table for the host route corresponding to the locally assigned IP address (157.60.136.41/32). The next-hop IP address is set to the destination IP address (157.60.136.41) and the next-hop interface is set to the loopback adapter.

Top of page

For More Information

For more information about IP routing, consult the following resources:

•	TCP/IP Fundamentals for Microsoft Windows, Chapter 5 – IP Routing
•	Default Gateway Behavior for Windows TCP/IP
•	Understanding the IPv6 Routing Table

For any questions or feedback regarding the content of this column, please write to Microsoft TechNet.

For a list and additional information on all The Cable Guy columns, click here.