Making Sense of Windows Routing Tables

It’s amazing the way that time can go by. People tend to think of computers as being high tech, but the TCP/IP protocol has been around in one form or another for over three decades. As such, TCP/IP has had time to really mature and be made stable and reliable. When it comes to computers, nothing is foolproof though. When routing packets across a network, things do occasionally go wrong. In these situations, it is helpful to be familiar with the Windows routing tables. Routing tables dictate the flow of packets from the machine in question. In this article, I will show you how to view the Windows routing tables and how to make sense of the data that is contained within it.

Viewing the Routing Tables

The routing tables are an important part of Windows’ TCP/IP protocol stack, but they aren’t something that the operating system normally displays to the casual user. If you want to see the routing tables, you will have to open a Command Prompt window and then enter the ROUTE PRINT command. Upon doing so, you will see a screen similar to the one that’s shown in Figure A.

Figure A: This is what the Windows routing tables look like

Before I delve into the routing tables, I recommend entering another command into the Command Prompt window. The command is:

IPCONFIG /ALL

The reason why I am recommending that you use the IPCONFIG /ALL command is because it shows you how TCP/IP is really setup on the machine. Sure, you could look in the TCP/IP section of the network adapter’s properties sheet, but the information is more reliable if you get it from IPCONFIG. I have seen a couple of instances over the years in which IPCONFIG reported completely different information than what was entered into the machine’s TCP/IP configuration screen. This doesn’t happen often, but if the right type of error occurs you can experience this type of mismatch. To put it bluntly, the information that’s keyed into the TCP/IP properties sheet reflects how you would like Windows to set up the TCP/IP protocol for the choosen network. The information presented by IPCONFIG shows how Windows has actually configured the protocol.

Even if you haven’t had some bizarre Windows error, it’s still useful to get your configuration information through IPCONFIG. If a machine has multiple network cards, it can be tough to remember which configuration is bound to which card. IPCONFIG lists the various configurations in an easy to read, per NIC basis, as shown in Figure B.

Figure B: The IPCONFIG /ALL displays the machine’s TCP/IP configuration on a per NIC basis

Examining the Routing Tables

Right about now you might be wondering why I had you to do an IPCONFIG /ALL, when this article is supposed to be discussing routing tables. The reason for this is that normally you never even look at the routing tables unless you are having problems with your machine. If you are having problems, then the best place to start the troubleshooting process is to compare the information provided by IPCONFIG to the information stored in the routing tables.

As you saw in Figure B, the IPCONFIG /ALL screen displayed some basic TCP/IP information such as the IP address, the default gateway, etc. The routing tables aren’t quite as intuitive though. Therefore, I want to take some time to discuss how to read the routing tables and what the information in the tables mean.

In order to understand what the information in these columns mean, you need to understand a little bit about how a router works. A router’s job is to facilitate moving traffic from one network to another. As such, a router will contain multiple network interface cards, each connected to a different network segment.

When a user sends a packet that’s destined for a different network segment than the one that the PC is presently attached to, the packet is sent to the router. It is up to the router to figure out which network segment the packet should be forwarded to. It doesn’t matter if the router is connected to two network segments or a dozen. The decision making process is the same, and it’s all based on routing tables.

If you look at the Route Print screen, you will notice that the routing tables are divided into five different columns. The first column is the network destination column. This column lists all of the network segments that the router is attached to. The Netmask column provides the subnet mask not of the network interface that’s attached to the segment, but of the segment itself. This basically allows the router to determine the address class for the destination network.

The third column is the gateway column. Once the router has determined which destination network it needs to send the packet to, it looks at the gateway listing. The gateway listing tells the router which IP address the packet should be forwarded through in order to reach the destination network.

The Interface column tells the router which NIC is connected to the appropriate destination network. Technically, the interface column only tells the router the IP address that has been assigned to the NIC that connects the router to the destination network. However, the router is smart enough to know which physical interface the address has been bound to.

The final column in the routing table is the Metric column. Metrics are a science in themselves, but I will try to give you a brief explanation of what they do. The best way that I have ever heard metrics explained is in terms of an airport. Imagine for a moment that I needed to fly from Charlotte, NC (the closest major airport to my home in South Carolina) to Miami, Florida. Being that the Charlotte airport is pretty big, I have a lot of choices of how I could get to Miami Beach. I could hop a North West Airlines flight. It would take me to Detroit Michigan and then down to Miami (Detroit is a bit out of the way). Likewise, I could hop a Continental Airlines flight that would take me to Houston, TX, and then to Miami. Another option would be to just take a US Airways flight nonstop to Miami. So which airline should I take?

In real life, there are a lot of factors to consider such as the price of the ticket and the departure times, but let’s assume that everything was equal. If there were no differences between the airlines other than the route, then I would fly the airline that makes the fewest stops. It would get me to my destination more quickly, and since there are fewer stops, there would be less chance of having a problem with my connection, lost luggage, and things like that.

Routing works the same way. Many times, there is more than one way that a router could send a packet. In such a case, it makes sense to send the packet along the shortest (or most reliable) path. This is where the metrics come into play. Windows does not even look at metrics unless there are multiple paths to a destination. If there are multiple paths though, Windows checks the metrics to determine the shortest route. This is an over simplified explanation, but it gets the point across.

Additional Routing Options

Earlier, I showed you the Route Print command, but there are actually a lot of other things that you can do with the ROUTE command. The ROUTE command’s syntax is as follows:

ROUTE [-f] [-p] [command [destination] []

The –f switch is optional. This switch tells Windows to clear the routing table of all gateway entries. If the –f switch is used in conjunction with other commands then all gateway entries will be cleared prior to executing other instructions within the command.

The –p switch makes a specified route persistent. Normally, when a server is rebooted then any routes that you specify via the ROUTE command are removed. The –p switch tells Windows to keep the route even if the system is rebooted.

The command portion of the ROUTE command’s syntax is relatively simple. The command set consists of four options PRINT, ADD, DELETE, and CHANGE. I’ve already shown you the ROUTE PRINT command, but even the ROUTE PRINT command has other options. For example, you can use wild cards with this command. For instance, if you only wanted to print routes pertaining to the 192.x.x.x subnet, you could use the command ROUTE PRINT 192*.

The ROUTE DELETE command works very similarly to the ROUTE Print command. Simply enter the ROUTE DELETE command followed by the destination or the gateway that you want to delete from the routing table. For example, if you wanted to remove the 192.0.0.0 gateway, you could enter the command ROUTE DELETE 192.0.0.0.

The ROUTE CHANGE and the ROUTE ADD commands have the same basic syntax as each other. When you enter this command, you must usually specify the destination, subnet mask, and gateway. You might also specify a metric and an interface, but that’s optional. For example, if you wanted to add a destination using the bare minimal syntax, you could do so as follows:

ROUTE ADD 147.0.0.0 255.0.0.0 148.100.100.100

In this command, 147.0.0.0 is the new destination that you are adding. 255.0.0.0 would be the subnet mask for the destination, and 148.100.100.100 would be the gateway address. You can extend the command with the METRIC and IF parameters. Doing so would look something like this:

ROUTE ADD 147.0.0.0 255.0.0.0 148.100.100.100 METRIC 1 IF 1

The metric parameter is optional, but it specifies the metric or number of hops for the route. The IF parameter tells Windows which NIC to use. In this particular case, Windows would use the NIC that’s bound to Windows as interface 1. If you don’t use the IF parameter then Windows will automatically search for the best interface to use.

Conclusion

In this article, I have explained how to use the ROUTE command to display the Windows routing tables and make changes to those tables if necessary. If you need a little extra help, you can get more syntax examples by entering the ROUTE /? Command.