September 1999

Understanding the TCP/IP Routing Table

Because most networks today use TCP/IP, it's important that you not only understand how to configure TCP/IP, but also that you understand how TCP/IP routes packets. Routing is the process your computer uses to transmit a packet between different subnets. If you want to communicate with a computer on a different subnet from your own, your computer must forward the data packets to a router. A router is the software and hardware responsible for delivering packets between two subnets. Each router uses an internal routing table to determine the best path to send a packet.

Each computer on which you install TCP/IP has its own routing table--whether the computer is a router or not. Computers use their routing tables to determine where to forward packets on the local network.

In this article, we're going to show you how to read and interpret your computer's TCP/IP routing table. We're also going to show you how to use the Route command to add, change, or delete routing table entries. Finally, we'll show you typical scenarios in which you might want to reconfigure your routing table in order to improve its performance.

Reading the routing table

Windows NT automatically builds your computer's routing table based on the configuration parameters you specify when you install TCP/IP. Windows NT uses your IP address, subnet mask, and the default gateway to build the routing table. Figure A displays a routing table on a computer configured with an IP address of 100.100.1.75, a subnet mask of 255.0.0.0, and a default gateway of 100.100.1.250.

Figure A: Each TCP/IP-based client maintains its own routing table.

Table A describes each of the columns in the routing table.

Table A: Identifying the columns in the routing table

Column Heading	Description
Network Address	Identifies a destination network address. This can be the address of a host, subnet, network, or default gateway.
Netmask	The subnet mask for the destination network address.
Gateway Address	The IP address to which your computer will forward a packet. Your computer uses this address if it can't find a route to the destination IP address in a packet.
Interface	Your computer's IP address (the address from which you send the packet). It's possible to have more than one network card and/or IP address assigned to your computer. Thus, Windows NT must know which address to send the packet from.
Metric	Specifies the cost of using that particular route. A higher number in the metric column indicates a higher cost for using that route. Windows NT uses the metric to determine the best route in case there's more than one way to get a packet to its destination.

Table B explains the purpose of each of the entries in the routing table shown in Figure A. When you send a packet, your computer uses its routing table to find the best possible route for the destination IP address in the packet. To find the best route, your computer first tries to find an exact match in its routing table for the destination IP address. If your computer can't find a match in its routing table, it next tries to find an entry for the network portion of the destination IP address. If your computer doesn't find a match for the destination network address, it will ultimately look for the IP address of its default gateway, and forward the packet to that address.

Table B: Understanding the role of the default routes in your routing table.

Network address	Purpose
0.0.0.0	This entry identifies your computer's default gateway. If your computer can't find a route to a destination IP address, it sends the packet to this address. In our example, the IP address of our default gateway is 100.100.1.250, and the packet will be sent from the network card with the address of 100.100.1.75.
100.0.0.0	This is an entry to the local network address as indicated by the Netmask 255.0.0.0. If your computer sends a packet to another computer on the same local network (such as to address 100.100.1.33), the gateway address specifies that the packet will be sent from the 100.100.1.75 local IP address.
100.100.1.75	This is an entry for the local IP address. Notice that the gateway and interface addresses specify to send the packet to the local loopback address of 127.0.0.1. Notice also that the Netmask of 255.255.255.255 masks the entire address.
100.255.255.255	This is the broadcast address for the 100.0.0.0 local network. It indicates that broadcast messages sent to the local network should be transmitted from the 100.100.1.75 IP address. Routers can be configured to forward these broadcasts.
127.0.0.0	This is the local loopback address. Any messages sent to this address are redirected to 127.0.0.1.
224.0.0.0	This address is used for IP multicasting. Multicasts will be transmitted via the 100.100.1.75 address.
255.255.255.255	This is an entry for the limited broadcast address. Broadcasts to this address will be sent out as indicated by the gateway address. This address is used to reach all other addresses on the subnet and won't cross routers.

If your computer can't find a route to the destination IP address and you don't have a default gateway address, you'll get an error message. If you get an error, make sure you note the actual message, because it can help you figure out the actual cause of the problem.

For example, when you use the ping command, the error Request timed out indicates that a route to the network in the destination IP address was found, and the message was sent--but that the destination computer didn't respond. In contrast, the error message Destination host unreachable indicates that your computer couldn't find a route to the destination IP address and thus didn't attempt to deliver the message to the destination computer.

Using the Route command

You can use the Route command to change the configuration of your computer's default routing table. You can use the command to add, delete, or modify any of the entries in the table. Figure B shows the Help screen for the Route command.

Figure B: Use the Route command to add, change, or delete entries from your computer's routing table.

This Help screen shows you the syntax for the Route command, as well as its available options.

As shown in Figure C, you can use the Route Print and Route Delete commands to work with your routing table.

Figure C: Use Route Delete to remove a route from your routing table.

Use the Route Print command to display the entries in your routing table. Use the Route Delete command to remove an existing entry from the routing table. Notice that to delete a route, all you have to do is specify the network address.

In our example, we deleted the local network address entry. You can see that the entry for the local network address was deleted by comparing the entries in the routing tables both before and after we issued the Delete command. Removing the local network address entry prevents us from communicating with all other computers on our local subnet.

Figure D shows the Route Add command.

Figure D: Use Route Add to add an entry to your routing table.

Use Route Add to add a new route to your routing table. Notice that we've indicated the network address, subnet mask, gateway address, and metric. If you don't specify the subnet mask in the Route Add command, it will use a subnet mask of 255.255.255.255. If you don't include the metric, it will default to 1. In this example, we've added our entry back for the local network address using a metric or cost of 2.

Finally, Figure E shows the Route Change command.

Figure E: Use Route Change to change an entry in your routing table.

Notice that we've specified all of the parameters for the route we're changing. The result of this command is that we've changed the metric from 2 back to 1. It's important to check your routing table after using the Route Change command, because if you mistype the network address, no change will occur but you won't receive an error indicating that fact.

Route parameters

You can use two parameters (switches) with the Route command. The -f parameter clears the routing table of any default gateway entries, as well as the local network entry. In our example, using the -f parameter would clear the 0.0.0.0 default gateway entry and the 100.0.0.0 local network address entry. Using the -f parameter along with one of the Route commands (such as Route Add or Route Delete) will cause your computer to first clear the routing table and then perform the command. For example, if you typed the command route -f add, your computer will clear the routing table and then add the new route. One of the new parameters (added in Windows NT 4.0) you can use with the Route command is -p for persistent routes. By default, the routes you add to the routing table aren't permanent. You lose these routes when you reboot your computer. However, if you use the command route -p add, Windows NT makes the permanent--so you won't lose the route when you reboot your computer. Windows NT stores persistent routes in the Registry. To view a list of persistent routes on your computer, use the command route -p print.

When should you add a route?

You should consider modifying your routing table any time that your computer has multiple paths to the same destination. Simply specifying a default gateway will get your packets to their destination--but not necessarily the most efficient way. Also, by configuring your computer to use a specific router as its default gateway, you could be placing an unnecessary load on that router. Let's take a look at an example where you might want to add a route to a client.

In this example, our client is located on subnet 1 and is trying to send a packet to a computer on subnet 4. We've configured the client's default gateway as Router A.

There isn't an entry for Router D in the client's routing table, so a message sent to subnet 4 would have to go through the client's default gateway. Router A would then most likely forward the message to Router D to be delivered to Subnet 4. The total number of hops, or routers crossed, to get the message to its destination is 2. The more hops you have between you and your destination, the longer the message takes to get to its destination.

In this example, we should use the Route Add command to add a route to our client's routing table. By specifying that messages destined for subnet 4 should go to Router D, we reduce the number of hops to 1. We used the following command:

route add 101.0.0.0 mask 255.0.0.0 100.0.0.2 metric 1

Once we've added this route, any packets the client sends with a destination network address of 101.0.0.0 would be routed through Router D (which has an IP address of at 100.0.0.2). You might think that another way you could solve this problem would be to configure our client with two default gateways, such as Router A and Router B. However, this won't accomplish the same thing. The client will use the second gateway only if the first gateway is unavailable. So, in our case, if we specified Router A as the client's first default gateway and Router B as the second default gateway, all packets for subnet 4 would still go through Router A unless it was unavailable--and only then would the client's packets go through Router B.

Conclusion

The TCP/IP routing table is an invaluable tool for both troubleshooting and tuning your network. By configuring your client routes properly, you can reduce (or at least redistribute) the traffic load on your network and increase its response time for your clients.

Copyright © 1999, ZD Inc. All rights reserved. ZD Journals and the ZD Journals logo are trademarks of ZD Inc. Reproduction in whole or in part in any form or medium without express written permission of ZD Inc. is prohibited. All other product names and logos are trademarks or registered trademarks of their respective owners.