understanding windows routing tables

Question

This is my current routing table (I rearranged it and grouped it by interface):

     Destination    Network mask          Gateway    Interface        Metric
          0.0.0.0          0.0.0.0    192.168.178.1    192.168.178.28     50

    192.168.178.0    255.255.255.0       On-link    192.168.178.28    306
   192.168.178.28  255.255.255.255       On-link    192.168.178.28    306
  192.168.178.255  255.255.255.255       On-link    192.168.178.28    306
        224.0.0.0        240.0.0.0       On-link    192.168.178.28    306
  255.255.255.255  255.255.255.255       On-link    192.168.178.28    306

        127.0.0.0        255.0.0.0       On-link         127.0.0.1    331 
        127.0.0.1  255.255.255.255       On-link         127.0.0.1    331 
  127.255.255.255  255.255.255.255       On-link         127.0.0.1    331 
        224.0.0.0        240.0.0.0       On-link         127.0.0.1    331 
  255.255.255.255  255.255.255.255       On-link         127.0.0.1    331 

     192.168.56.0    255.255.255.0      On-link      192.168.56.1    281 
     192.168.56.1  255.255.255.255      On-link      192.168.56.1    281 
   192.168.56.255  255.255.255.255      On-link      192.168.56.1    281 
  255.255.255.255  255.255.255.255      On-link      192.168.56.1    281 
        224.0.0.0        240.0.0.0      On-link      192.168.56.1    281 

    192.168.137.0    255.255.255.0      On-link     192.168.137.1    271 
    192.168.137.1  255.255.255.255      On-link     192.168.137.1    271 
  192.168.137.255  255.255.255.255      On-link     192.168.137.1    271 
        224.0.0.0        240.0.0.0      On-link     192.168.137.1    271 
  255.255.255.255  255.255.255.255      On-link     192.168.137.1    271 

a) The first line is the default route that should be taken if no other route matches, correct?. In that case, the packet should be sent over the interface 192.168.178.28 to my default gateway.

Is it correct that from the routing table I can tell that only the NIC with 192.168.178.28 has access to the internet? If the other NICs had, there would have to be an entry for the default gateway for theses NICs as well, right?

b) The line

192.168.178.0    255.255.255.0       On-link    192.168.178.28    306

means that any packet addressed to a host in the 192.168.178 network should leave via the 192.168.178.28 interface (my wireless NIC), right?

c) But what does this entry mean?

   192.168.178.28  255.255.255.255       On-link    192.168.178.28    306

Packets addressed to my computer should be sent via my wireless NIC? I don't really understand this entry. Where would the packet be coming from?

d) And this entry

  192.168.178.255  255.255.255.255       On-link    192.168.178.28    306

is a boradcast, isn't it? So when an application on my pc sends a packet to this address, it is a broadcast to any host inside the 192.168.178 network?

e) And then the next two entries:

 224.0.0.0        240.0.0.0      On-link    192.168.178.28    306
 255.255.255.255  255.255.255.255    On-link    192.168.178.28    306

• 224.0.0.0 is a multicast, right?
• And 255.255.255.255 is also a broadcast to any host inside my LAN? What is the differnce to 192.168.178.255 ?
• And why do these two entries exist for all of my NICs?

f) and one general question: I always thought that only routers have routing tables, but it must be the case that any system than has the IP protocol implemented has a routing table, so every tablet, smartphone and PC, right?

g) And a last one:

192.168.178.28 and 192.168.56.1 are on different subnets (according to the subnet mask). So when I want to send a packet from one to the other, the packet has to go through the router, even though both NICs are on my machine, correct?

Thanks for help and explanations!

Answer 1

In general, the routing table is organized by priority (so the order you show does not make too much sense). Windows shows the table upside down: first entry is the last rule (i. e. if all others fail, use this one).

For every IP destination, the whole table is processed in order and a match is sought. If several rules match, the smallest metric gets used.

a) Yes, the first line is the default route, if no other rule matches this one gets used.

It´s not strictly true that this interface has Internet access though: it´s the only interface that (hopefully) knows how to handle data to other networks not mentioned in other rules. If it points to a router for example, then Internet access is there...

b) yes, it´s a network entry

c) it´s a host entry: if an application is bound to 192.168.178.28 and would send data to this address. it would use the same interface (in general, routing tables allow host entries to permit special rules for specific hosts)

d) yes, it´s the local network broadcast for a specific nw

e) 224.... is multicast, yes. 255.255.255.255 is (in theory) a broadcast to the whole world. Luckily it only gets transmitted to the local interface though :-) If you would do a ping 255.255.255.255 this rule would "catch". A ping to 192.168.178.255 would use the other rule.

All interfaces must have full route info, so all rules are created by default for each nw interface.

f) Every device with an IP interface will have a routing table. The ones in routers can be much more complex, hosts usually have tables automatically created by the OS.

g) No, the routing table tells the IP stack to use the correct interface as the outgoing one, no need to send to the router. So if an application in your PC wants to send data to 192.168.56.x, it will send it through the 192.168.56.1 interface (which in your case appears to be a virtual NW card)