How to Read a Routing Table: route print and ip route Explained

When a machine sends a packet to an IP address, the routing table decides which interface the packet leaves from and which router (if any) receives it next. If that decision is wrong, traffic goes to the wrong network or disappears entirely. This page explains every column of route print (Windows) and ip route (Linux/macOS), what the metric actually does, and how to identify the entry that is sending traffic the wrong way.

The Routing Table at a Glance

A routing table is a list of known networks. Each entry tells the machine: “To reach this destination network, use this interface and this gateway (or none if directly connected).” When a packet needs to be sent, the machine looks for the most specific matching route — the one with the longest prefix length — and uses that entry. If multiple entries have the same prefix length, the metric breaks the tie.

Here is a sample route print output from a Windows machine:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.10    25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
      192.168.1.0    255.255.255.0         On-link      192.168.1.10    281
      192.168.1.10  255.255.255.255         On-link      192.168.1.10    281
      192.168.1.255  255.255.255.255         On-link      192.168.1.10    281
===========================================================================
Persistent Routes:
  None

And a sample ip route output from Linux:

$ ip route
default via 192.168.1.1 dev eth0 proto dhcp metric 100
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.10 metric 100

Both tables contain the same information, just formatted differently. The rest of this page maps each column.

Columns of route print

Network Destination and Netmask

Network Destination is the network address, and Netmask defines how many bits of that address must match for the route to apply. Together they form the prefix. For example, 192.168.1.0 with netmask 255.255.255.0 is the network 192.168.1.0/24. A packet destined for 192.168.1.50 matches this route because the first 24 bits of the destination match the first 24 bits of the network address.

The default route is 0.0.0.0 with netmask 0.0.0.0, which matches every destination. It is the route of last resort — used when no more specific route exists.

Gateway

Gateway is the next-hop IP address. If the destination is on a directly connected network, the gateway is On-link, meaning the machine can reach the destination without sending the packet to a router. If the gateway is an IP address, that address must be reachable through one of the machine’s interfaces — it cannot be on a network that the machine does not have a route to.

Interface

Interface is the local IP address of the network interface that the packet will leave from. For a directly connected route, this is the machine’s own IP on that network. For a route via a gateway, it is the IP of the interface that connects to the gateway’s network.

Metric

Metric is a cost associated with the route. When two routes have the same prefix length, the one with the lower metric is chosen. The metric is not a measure of speed; it is an administrative preference. Windows calculates a default metric for each interface based on link speed (faster links get lower metrics), but it can be overridden manually. Linux uses a similar concept, but the metric is often set by the routing protocol or manually.

Columns of ip route

Linux’s ip route output is more compact. Each route is shown as a prefix, followed by attributes. The key parts are:

• default — shorthand for 0.0.0.0/0.
• via — the gateway IP. If absent, the route is directly connected.
• dev — the interface name (e.g., eth0).
• proto — the protocol that added the route (e.g., kernel for automatically added, dhcp for DHCP-assigned, static for manually added).
• metric — the cost, same as Windows.
• scope — usually link for directly connected routes, meaning the destination is on the same link.

How the Metric Really Decides

The metric only matters when two routes have the same prefix length. For example, if a machine has two interfaces, both connected to different networks, and both have a default route (0.0.0.0/0), the metric decides which one is used for all traffic that does not match a more specific route. The route with the lower metric wins.

A common misconception is that the metric is used to choose between a specific route and a default route. It is not. The longest prefix match always wins, regardless of metric. For instance, a route to 192.168.2.0/24 will always be used for traffic to 192.168.2.10, even if the default route has a much lower metric.

Spotting the Wrong Route

When traffic goes the wrong way, the culprit is usually a route that is more specific than it should be, or a default route pointing to the wrong gateway. To diagnose, follow these steps:

1. Identify the destination IP address that is failing.
2. Look for the route with the longest prefix that matches that IP.
3. Check if that route’s gateway and interface are correct.
4. If the route is wrong, you can either delete it or add a more specific route to override it.

For example, if a machine has a route to 0.0.0.0/0 via 192.168.1.1, but also a route to 192.168.1.0/24 via 192.168.1.1, traffic to 192.168.1.100 will use the specific route (since it is directly connected) and will not go through the gateway. That is correct. But if there is a route to 192.168.1.0/24 via 192.168.2.1 (a wrong gateway), traffic to 192.168.1.100 will be sent to that gateway, which may drop it.

Comparison: When Each Route Type Applies

What People Get Wrong About This

A natural mistake is to think that the metric is the primary factor in route selection. It is not. The longest prefix match is always evaluated first. Many people see two routes to the same network with different metrics and assume the lower metric will always be used, but if one route has a longer prefix (e.g., /24 vs /16), the longer prefix wins regardless of metric. This confusion is understandable because the metric is the only visible difference between two otherwise identical routes, and it is what is commonly adjusted to influence routing.

Another common error is misreading the Gateway column. When the gateway is On-link, the destination is directly reachable — the packet is sent out the interface without going through a router. Some people mistake On-link for a gateway IP and try to ping it, which fails because it is not an address. Understanding that On-link means “no gateway” is essential.

Finally, people often overlook the Interface column. If the interface is wrong, the packet may be sent out a network that cannot reach the gateway. For example, a route might say Gateway 192.168.1.1, Interface 192.168.2.10, which is invalid because the gateway is not on the same network as the interface. This can happen after a configuration change and will cause traffic to fail.

Viewing and Modifying Routes

To view the routing table on Windows, use route print. On Linux or macOS, use ip route (or route -n for a simpler output). To add a route on Windows, use route add with the -p flag to make it persistent. On Linux, use ip route add. To delete a route, use route delete (Windows) or ip route del (Linux).

These commands are for reference; the exact syntax is available in the built-in help (route /? or man ip-route).

Understanding the routing table is a matter of reading the columns correctly and remembering that the longest prefix match is king. Once that is clear, most routing problems become a matter of finding the offending entry and correcting it.