Re: Routing

Dave J. wrote:
> Would someone be kind enough to satisfy my curiousity here?
>
> I thought that for any destination IP (possibly apart from private IPs
> depending on configurations) where there isn't a permanent route and
> there's nothing in the local routing table, that any packet sent there
> would be automatically initially passed via the default exit interface (in
> this case the *only* NIC) to the mac address of the default gateway?

Correct. Basically what happens is this:
1. The routing table is consulted to make a routing decision based on
the destination IP address. Assuming no more-specific route is found,
the default route will be used. The route specifies the IP address of
the interface to use and the default gateway ("router").
2. The ARP table is consulted to find the MAC address of the router.
3. If the MAC address is not in the ARP table, an ARP "who-has" query is
broadcast, and the process continues once a reply is received.
4. The packet is forwarded; the layer 3 (IP) destination address will be
the original destination and the layer 2 (Ethernet) address will be that
of the router.

> So, for google (74.125.127.100) I do a ms tracert and the first TTL expiry
> reply is from my local router at 10.32.32.128. This seems to be true for
> many (most?) addresses that are outside my local network.
>
> However, if I try it to 6.0.0.0/8 or 7.0.0.0/8 I don't even get the first
> expiry packet. It's as if my machine has a route for these addresses via a
> non existent interface.
>
> Can anyone explain what's going on? The addresses are legitimately 'owned'
> and there is nothing in my routing table that mentions them. I even
> cleared the table and poked the default route back into place. Everything
> stayed exactly the same.

Something on the PC or router (eg firewall) is interfering. The former
is more likely based on the reported absence of ARP.

> Even if I 'owned' (leased) a 'proper' class B sized network and my router
> exchanged routing information (perhaps someone would enlighten me on which
> of the (two?) sorts of routable network I mean?) and even if there was no
> legitimate route for those IPs, surely I would *still* get a TTL expired
> from my default gateway? My machine certainly doesn't know anything about
> global network routing, so why does it decide that there's nowhere
> sensible to send the packets destined for these IPs?

Even if it did, "no route to host" instead seems likely.

[big snip]

Alex